6

According to this CiviCRM wiki page, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the existing contact. While this helps to prevent contact duplication, it seems like it could also represent a potential security problem.

A simple scenario: a membership organization has migrated their existing CRM data to CiviCRM. They would like new members to be able to sign up online, so they allow anonymous Drupal user account creation. Existing members are encouraged to create Drupal users (which get automatically associated with their CiviCRM contact information) so that they can renew their memberships online.

In this scenario, what prevents a malicious person from using an existing contact's e-mail address during Drupal user registration? Using an existing contact's e-mail address (which can be assumed to be fairly public information) would potentially give the malicious person access to all of that contact's personal information, and (if Rules synchronization is implemented) access to other parts of the website they shouldn't have access to.

This appears to me to be a security hole with the potential to expose personal information; am I missing something? How can this be mitigated?

  • 2
    We had an issue that was sort of similar. We have a signup process that consists of multiple Drupal webforms chained together so it saves at each stage. With Civi's automatic dedupe enabled, when someone filled in the first page with an existing contact's name and email, the created contact was deduped and when they got to the second page the contact's existing details were disclosed. At the time (this was a good couple of years ago) we turned off the automatic deduping. – DaveFF Jul 12 '16 at 17:43
7

It is but isn't specific to civicrm - the problem in that scenario is allowing anonymous signup without either administrator approval or email verification. Set at least the setting in drupal user settings that sends an email to the email on file and then the owner would have to click a link to verify it.

  • E-mail verification. That's what I was missing. Thank you very much! – Russell Ault Jul 9 '16 at 21:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.