CVE-2025-10930: Drupal Currency CSRF Vulnerability

CVE-2025-10930 Overview

CVE-2025-10930 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Drupal Currency contributed module maintained by 2bits. The flaw impacts all Currency releases from 0.0.0 before 3.5.0. An attacker can craft a malicious page or link that, when visited by an authenticated Drupal user, triggers unintended state-changing actions in the Currency module. The vulnerability is categorized under CWE-352 and requires user interaction over the network. Site operators running the Currency module on Drupal should upgrade to version 3.5.0 or later.

Critical Impact
Authenticated Drupal users can be tricked into performing unintended actions in the Currency module through forged HTTP requests originating from attacker-controlled pages.

Affected Products

2bits Currency module for Drupal, versions 0.0.0 through 3.4.x
Drupal sites with the Currency contributed module installed and enabled
Fixed in Currency version 3.5.0

Discovery Timeline

2025-10-30 - CVE-2025-10930 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10930

Vulnerability Analysis

The Currency module exposes state-changing endpoints that do not properly validate the origin of incoming requests. Because the module relies on the authenticated user's session cookie without enforcing a per-request anti-CSRF token, a cross-origin request from an attacker-controlled page inherits the victim's authenticated session. The attacker cannot read responses, but the server processes the forged request as legitimate. This lines up with CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, such as clicking a link or loading a page containing a hidden form or image tag targeting the vulnerable endpoint.

Root Cause

The root cause is missing or insufficient CSRF token validation on privileged routes within the Currency module. Drupal provides built-in CSRF token utilities, but the affected code paths did not consistently apply them prior to version 3.5.0.

Attack Vector

An attacker hosts a page containing HTML or JavaScript that issues a request to a Drupal site running the vulnerable Currency module. When a logged-in administrator or privileged user visits the page, the browser attaches the session cookie and the server executes the requested action. The attack vector is network-based and does not require credentials on the attacker's side, only that a victim with sufficient privileges interacts with the malicious content.

No verified public proof-of-concept code is available for this issue. Refer to the Drupal Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-10930

Indicators of Compromise

Unexpected state changes in Currency module configuration or data performed by legitimate administrator accounts
HTTP POST, PUT, or DELETE requests to Currency module routes with Referer or Origin headers pointing to unrelated external domains
Web server access logs showing Currency endpoints accessed immediately after users load external links from email or chat

Detection Strategies

Enable and review Drupal watchdog or dblog entries for administrative Currency actions and correlate them with the initiating user's session activity
Inspect reverse proxy or web application firewall logs for cross-origin requests to Currency URLs lacking a valid CSRF token parameter
Hunt for repeated failed CSRF token validations in Drupal logs after the module is updated, which may indicate prior probing

Monitoring Recommendations

Alert on modifications to Currency module configuration outside approved change windows
Monitor Referer and Origin HTTP headers on authenticated administrative routes and flag mismatches with the site's canonical hostname
Track privileged Drupal user sessions and correlate outbound clicks with subsequent administrative actions

How to Mitigate CVE-2025-10930

Immediate Actions Required

Upgrade the Currency module to version 3.5.0 or later on all Drupal environments
Audit recent Currency configuration changes and revert any unauthorized modifications
Require administrators to log out of Drupal when not actively performing tasks to reduce the window for CSRF exploitation

Patch Information

The vendor fix is available in Currency 3.5.0. See the Drupal Security Advisory SA-CONTRIB-2025-110 for release notes and download links. Apply the update using composer update drupal/currency and run drush updatedb followed by a cache rebuild.

Workarounds

If immediate patching is not possible, disable the Currency module until it can be upgraded
Restrict administrative access to Drupal by IP allowlist at the reverse proxy or firewall layer
Enforce SameSite=Strict or SameSite=Lax on Drupal session cookies to reduce cross-site request success

bash

# Configuration example: upgrade Currency module via Composer and Drush
composer require 'drupal/currency:^3.5.0' --update-with-dependencies
drush updatedb -y
drush cache:rebuild