CVE-2025-13982: Drupal Login Time Restriction CSRF Flaw

CVE-2025-13982 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Drupal Login Time Restriction module. This security flaw allows attackers to forge malicious requests that execute actions on behalf of authenticated users without their consent. The vulnerability exists in versions prior to 1.0.3 of the Login Time Restriction module, which is used to control when users can log into Drupal-based websites.

Critical Impact

Attackers can exploit this CSRF vulnerability to manipulate login time restriction settings or perform unauthorized administrative actions on affected Drupal installations, potentially compromising access control mechanisms.

Affected Products

• Drupal Login Time Restriction module versions 0.0.0 through 1.0.2
• Drupal websites utilizing the vulnerable Login Time Restriction module
• Web applications built on Drupal CMS with this contributed module installed

Discovery Timeline

• 2026-01-28 - CVE-2025-13982 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-13982

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability (CWE-352) occurs when the Drupal Login Time Restriction module fails to properly validate that state-changing requests originate from the legitimate user. CSRF attacks exploit the trust that a web application has in an authenticated user's browser, allowing attackers to trick users into performing unintended actions.

The vulnerability requires user interaction, specifically that a victim with appropriate privileges must visit a malicious page or click a crafted link while authenticated to the target Drupal site. Upon successful exploitation, attackers can modify login time restrictions, potentially locking out legitimate users or granting unauthorized access windows to malicious actors.

Root Cause

The root cause of this vulnerability is the absence or improper implementation of anti-CSRF tokens in the Login Time Restriction module's forms and state-changing endpoints. Without proper CSRF protection mechanisms such as synchronizer tokens or SameSite cookie attributes, the module cannot distinguish between legitimate user-initiated requests and forged requests from external origins.

Attack Vector

The attack is network-based and requires an authenticated administrator or privileged user to interact with a malicious resource. An attacker would craft a malicious webpage containing hidden forms or JavaScript code that automatically submits requests to the vulnerable Drupal module endpoints. When a logged-in administrator visits this malicious page, their browser sends the forged request along with their valid session cookies, causing the server to process the request as legitimate.

Typical attack scenarios include:

1. Embedding malicious HTML in phishing emails that link to attacker-controlled pages
2. Injecting malicious content into legitimate websites via other vulnerabilities
3. Using social engineering to convince administrators to visit malicious URLs

The vulnerability can lead to unauthorized modification of login time restriction policies, potentially disrupting normal user access or creating security gaps in the authentication schedule.

Detection Methods for CVE-2025-13982

Indicators of Compromise

• Unexpected changes to login time restriction configurations without administrator action
• Audit logs showing configuration modifications originating from unusual referrer URLs
• Reports from administrators of actions they did not perform on the Login Time Restriction module
• Anomalous HTTP POST requests to module endpoints from external referrer domains

Detection Strategies

• Monitor Drupal watchdog logs for unexpected changes to login time restriction settings
• Implement web application firewalls (WAF) with CSRF detection rules to identify suspicious cross-origin requests
• Review access logs for requests to Login Time Restriction administrative endpoints with unusual referrer headers
• Deploy SentinelOne Singularity XDR to correlate web server logs with endpoint behavior for comprehensive threat detection

Monitoring Recommendations

• Enable verbose logging for the Drupal Login Time Restriction module to capture all configuration changes
• Configure alerts for any modifications to login restriction policies outside of maintenance windows
• Implement Content Security Policy (CSP) headers and monitor for policy violations that may indicate CSRF attempts
• Regularly audit administrator activity logs to identify unauthorized or suspicious actions

How to Mitigate CVE-2025-13982

Immediate Actions Required

• Update the Drupal Login Time Restriction module to version 1.0.3 or later immediately
• Review and verify current login time restriction configurations have not been maliciously altered
• Educate administrators about CSRF attack vectors and the importance of not clicking suspicious links while authenticated
• Consider temporarily disabling the module if immediate patching is not possible

Patch Information

The Drupal security team has released version 1.0.3 of the Login Time Restriction module which addresses this CSRF vulnerability. Organizations should update to this version or later as soon as possible. For complete patch details and installation instructions, refer to the Drupal Security Advisory.

To update the module via Composer:

composer update drupal/login_time_restriction
drush cr

Workarounds

• Restrict access to the Login Time Restriction module's administrative pages to trusted IP addresses only
• Implement additional WAF rules to validate the Origin and Referer headers on state-changing requests
• Use browser extensions that block cross-site requests for administrative sessions
• Configure strict Content Security Policy headers to limit the origins that can submit forms to your Drupal site

# Example Apache configuration to add CSRF-related security headers
<IfModule mod_headers.c>
    # Set X-Frame-Options to prevent clickjacking
    Header always set X-Frame-Options "SAMEORIGIN"
    
    # Restrict embedding in frames from other origins
    Header always set Content-Security-Policy "frame-ancestors 'self';"
    
    # Enable browser XSS protection
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>