Sarah Mason
Hi AtoM Community,
As per our forum notification from last week, Artefactual is announcing the release of the security patch and installation instructions.
The issue:
AtoM versions 2.5 to 2.10 contain an access-control issue affecting one or more unauthenticated endpoints. Under specific conditions, an unauthenticated user could access limited user-account metadata (specifically: usernames, email addresses, and user role). It is also possible under specific conditions to access the title of draft archival descriptions.
We are not aware of any exploitation of this vulnerability. The issue does not expose passwords, authentication tokens, any other private metadata in archival descriptions (other than title of draft records noted above), or uploaded files.
How to apply the fix:
Download the patch file from: https://gist.github.com/qubot/b7875f864acb41bd39890f701e66c4a5
From within the AtoM folder, run the following commands as AtoM or nginx user to apply the patch:
git apply /path/to/patch/file/security_yml.patch
Or alternatively, if you installed AtoM from the tarball, and do not use git, run:
patch -p 1 < /path/to/patch/file/security_yml.patch
Note that users of AtoM 2.7.x and above should use the security_yml.patch, and users of AtoM 2.5.x and 2.6.x should use 2.5-security_yml.patch.
After the patch is applied, to clear the cache so that the changes take affect, run:
php symfony cc
systemctl restart php8.1-fpm.service (use the php version that is installed if not using php 8.1)
systemctl restart memcached.service
After applying the security fix, there is a minor change affecting advanced search functionality for unauthenticated users. For users who are not logged in, ‘typeahead’ for the top-level descriptions field in Advanced Search for Information Objects will no longer function. A future release of AtoM will include a fix for this issue in the code, at which point the patch described here can be removed.
If you have any questions, please do not hesitate to contact me or the Community Team at contri...@artefactual.com.
Best wishes,
Sarah
Sarah Mason
Contributor Success Specialist
Artefactual Systems Inc.
she/her