- Security-news - lists.drupal.org

SA-CONTRIB-2012-044 - Contact Forms - Cross Site Scripting
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-044 * Project: Contact Forms [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module expands the features of the site wide contact form. It eliminates the drop down category menu by generating a clean looking contact form with a unique path, for each of the contact form categories. The module doesn't sufficiently filter user text of the page title and additional information, leading to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site-wide contact form" and the core contact form needs to be enabled. -------- VERSIONS AFFECTED --------------------------------------------------- * Contact forms 6.x-1.x versions prior to 6.x-1.13 [3]. Drupal core is not affected. If you do not use the contributed Contact Forms [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Contact Forms module for Drupal 6.x, upgrade to 6.x-1.13 [5] Also see the Contact Forms [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Geoff Davies [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/contact_forms [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1506330 [4] http://drupal.org/project/contact_forms [5] http://drupal.org/node/1506330 [6] http://drupal.org/project/contact_forms [7] http://drupal.org/user/383424 [8] http://drupal.org/user/29262 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-043 - MultiBlock - Cross Site Scripting
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-0XX * Project: MultiBlock [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The MultiBlock module allows an administrator to create multiple instances of blocks provided by other modules. The module does not properly sanitize the block title provided by a block administrator, leading to a cross-site scripting (XSS) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must have a role with the permission 'administer blocks' to exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * MultiBlock 6.x-1.x versions prior to 6.x-1.4. * MultiBlock 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed MultiBlock [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the MultiBlock module for Drupal 6.x, upgrade to MultiBlock 6.x-1.4 [4] * If you use the MultiBlock module for Drupal 7.x, upgrade to MultiBlock 7.x-1.1 [5] Also see the MultiBlock [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin Klein Keane [7] -------- FIXED BY ------------------------------------------------------------ * Andrew Levine [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/multiblock [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/multiblock [4] http://drupal.org/node/1505410 [5] http://drupal.org/node/1505414 [6] http://drupal.org/project/multiblock [7] http://drupal.org/user/302225 [8] http://drupal.org/user/49940 [9] http://drupal.org/user/383424 [10] http://drupal.org/user/102818 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-042 - Wishlist Cross Site Scripting (XSS)
by security-news＠drupal.org 21 Mar '12

21 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-042 * Project: Wishlist Module [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-21 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Wishlist Module allows users to maintain shared wishlists for special events and holidays. Impact: The module doesn't sufficiently filter user supplied text from the URL. This can be used to perform a reflected cross site scripting (XSS) attack. User account credentials could be exposed or compromised, or users could be redirected to sites designed for phishing or hosting malware. This vulnerability is mitigated by the fact that users must be tricked into visiting a specific link and then manipulating the show/hide purchase details drop down. This drop down is only rendered if the user is viewing their own Wish List and the module is configured to hide the purchased status from them. -------- VERSIONS AFFECTED --------------------------------------------------- * Wishlist Module 6.x-2.x versions prior to 6.x-2.6. * Wishlist Module 7.x-2.x versions prior to 7.x-2.6. Drupal core is not affected. If you do not use the contributed Wishlist Module [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Wishlist module for Drupal 6.x, upgrade to Wishlist 6.x-2.6 [4] * If you use the Wishlist module for Drupal 7.x, upgrade to Wishlist 7.x-2.6 [5] See also the Wishlist Module [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin Klein Keane [7] -------- FIXED BY ------------------------------------------------------------ * Scott McLewin [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/wishlist [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/wishlist [4] http://drupal.org/node/1483634 [5] http://drupal.org/node/1483636 [6] http://drupal.org/project/wishlist [7] http://drupal.org/user/302225 [8] http://drupal.org/user/33718 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-041 - Fancy Slide - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-041 * Project: Fancy Slide [1] (third-party module) * Version: 6.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create slideshow blocks to embed into templates. The module doesn't sufficiently filter user supplied text. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fancy_slide". -------- VERSIONS AFFECTED --------------------------------------------------- * Fancy Slide 6.x-2.x versions prior to 6.x-2.6. Drupal core is not affected. If you do not use the contributed Fancy Slide [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Fancy Slide module for Drupal 6.x, upgrade to Fancy Slide 6.x-2.7 [4] See also the Fancy Slide [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justine Klein Keane [6] -------- FIXED BY ------------------------------------------------------------ * Justine Klein Keane [7] * Paul Lomax [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stella Power [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/fancy_slide [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/fancy_slide [4] http://drupal.org/node/1417688 [5] http://drupal.org/project/fancy_slide [6] http://drupal.org/user/302225 [7] http://drupal.org/user/302225 [8] http://drupal.org/user/253872 [9] http://drupal.org/user/66894 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-040 * Project: CKEditor [1], FCKeditor [2] - WYSIWYG HTML editor (third-party module) * Version: 6.x, 7.x * Date: 2012-March-14 * Security risk: Highly critical [3] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- CKEditor and its predecessor FCKeditor allow Drupal to replace textarea fields with the (F)CKEditor - a visual HTML WYSIWYG editor. The modules have an AJAX callback that filters text to prevent Cross site scripting attacks on content edits. This AJAX callback function contains a number of bugs which allow attackers to chose which filter to execute on chosen text or bypass the filter entirely. The vulnerability can be used to conduct Cross site scripting (XSS) attacks on privileged users. Attackers can also execute arbitrary PHP code if the core PHP module is enabled. This can happen either directly or by enticing a privileged user to visit a page. Direct execution of PHP code requires that the attacker has the following privileges: "access fckeditor" for FCKeditor 6.x "access ckeditor" for CKEditor 6.x No additional permissions are required to directly exploit the PHP code execution flaw on CKEditor 7.x. -------- VERSIONS AFFECTED --------------------------------------------------- * FCKeditor 6.x-2.x versions prior to 6.x-2.3. * CKEditor 6.x-1.x versions prior to 6.x-1.9. * CKEditor 7.x-1.x versions prior to 7.x-1.7. Drupal core is not affected. If you do not use the contributed CKEditor - WYSIWYG HTML editor [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the FCKeditor module for Drupal 6.x, upgrade to FCKeditor 6.x-2.3 [5]. * If you use the CKEditor module for Drupal 6.x, upgrade to CKEditor 6.x-1.9 [6]. * If you use the CKEditor module for Drupal 7.x, upgrade to CKEditor 7.x-1.7 [7]. See also the CKEditor - WYSIWYG HTML editor [8] project page. -------- REPORTED BY --------------------------------------------------------- * Heine Deelstra [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Wiktor Walc [10] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/ckeditor [2] http://drupal.org/project/fckeditor [3] http://drupal.org/security-team/risk-levels [4] http://drupal.org/project/ckeditor [5] http://drupal.org/node/1482442 [6] http://drupal.org/node/1482480 [7] http://drupal.org/node/1482466 [8] http://drupal.org/project/ckeditor [9] http://drupal.org/user/17943 [10] http://drupal.org/user/184556 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-039 - Language Icons - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-039 * Project: Language icons [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Language icons module adds icons to language links generated by the Locale and Content Translation modules in core. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [3]) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer languages". -------- VERSIONS AFFECTED --------------------------------------------------- * Language icons 6.x-2.x versions prior to 6.x-2.1. * Language icons 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Language icons [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Language icons module for Drupal 6.x, upgrade to Language icons 6.x-2.1 [5] * If you use the Language icons module for Drupal 7.x, upgrade to Language icons 7.x-1.0 [6] See also the Language icons [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jose Reyero [8] the original module author * Frederik "Freso" S. Olesen [9] the current module maintainer -------- FIXED BY ------------------------------------------------------------ * Frederik "Freso" S. Olesen [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/languageicons [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/languageicons [5] http://drupal.org/node/1482144 [6] http://drupal.org/node/1482136 [7] http://drupal.org/project/languageicons [8] http://drupal.org/user/4299 [9] http://drupal.org/user/27504 [10] http://drupal.org/user/27504 [11] http://drupal.org/user/36762 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-038 - Views Language Switcher Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-038 * Project: Views Language Switcher [1] (third-party module) * Version: 7.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Views Language Switcher module enables you to provide natively-formatted links that act as Views exposed filters for i18n content being displayed by Views. The module doesn't sufficiently filter the path output when a user manually modifies the path and makes a new request. This vulnerability can be exploited by anonymous users. -------- VERSIONS AFFECTED --------------------------------------------------- * Views Language Switcher 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Views Language Switcher [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views Language Switcher module for Drupal 7.x, upgrade to Views Language Switcher 7.x-1.2 [4] See also the Views Language Switcher [5] project page. -------- REPORTED BY --------------------------------------------------------- * Chris Ruppel [6] -------- FIXED BY ------------------------------------------------------------ * Chris Ruppel [7] the module maintainer * Greg Knaddison [8] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/views_lang_switch [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/views_lang_switch [4] http://drupal.org/node/1482268 [5] http://drupal.org/project/views_lang_switch [6] http://drupal.org/user/411999 [7] http://drupal.org/user/411999 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-037 - Slidebox - access bypass
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-037 * Project: Slidebox [1] (third-party module) * Version: 7.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Slidebox [3] module allows webmasters do display a link to the next node in a jQuery box that slides in from the right side of the page after a user scrolls past a certain point. While the module checks for "published" status, the module does not contain sufficient usage of node_access() to prevent users from accessing content that they do not have proper permission to access (for example, nodes or node types that have been protected via an access control module). -------- VERSIONS AFFECTED --------------------------------------------------- * Slidebox 7.x-1.x versions prior to and including 7.x-1.3. * Slidebox 7.x-2.x-dev Drupal core is not affected. If you do not use the contributed Slidebox [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Slidebox module for Drupal 7.x, upgrade to Slidebox 7.x-1.4 [5] See also the Slidebox [6] project page. -------- REPORTED BY --------------------------------------------------------- * Joshua Brauer [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Brian Altenhofel [8] - the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team * Dave Reid [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/slidebox [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/slidebox [4] http://drupal.org/project/slidebox [5] http://drupal.org/node/1482166 [6] http://drupal.org/project/slidebox [7] http://drupal.org/user/12363 [8] http://drupal.org/user/550616 [9] http://drupal.org/user/102818 [10] http://drupal.org/user/53892 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-036 - Multiple Modules Unsupported
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-036 * Projects: Content Lock [1], Ubercart Bulk Stock Updater [2], Ubercart Payflow Link [3], ticketyboo News Ticker [4], Admin tools [5], Redirecting click bouncer [6] (third-party modules) * Version: 6.x * Version: 7.x * Date: 2012-March-14 * Security risk: Critical [7] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Content Lock [8] Is a module that prevents users from concurrent editing of nodes. This module does not use a token for unlocking a content lock. This leads to a CSRF attack vector. Ubercart Bulk Stock Updater [9] is an extension module for Ubercart 2.x running on Drupal 6.x which makes it easy to bulk-edit product stock levels. This module does not properly use the formAPI and this results in a CSRF attack vector. Ubercart Payflow Link [10] is a payment solution for ubercart provided by PayPal. This module does not use a secure token and thus could allow payments to be forged. ticketyboo News Ticker [11]is a module that lets you configure three separate news tickers as Drupal Blocks. This module does not filter output correctly leading to a XSS attack vector. It may also have a SQL injection vector. Admin tools [12] This package will contain a complete set of tools for managing several drupal installs. This module does not properly filter text leading to a XSS attack vector, as well as not checking tokens leading to a CSRF attack vector. Redirecting click bouncer [13], is a module that lets you create links to a target that simply redirects to the real destination. The redirect happens server-side which means that we can track the redirects. This comes handy when we have links in our site and we need to know when they are clicked. This module does not check the URL to redirect to, this create an open redirect. -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of Content Lock are affected by vulnerabilities. * All versions of Ubercart Bulk Stock Updater payment are affected by vulnerabilities. * All versions of Ubercart Payflow Link are affected by vulnerabilities. * All versions of ticketyboo News Ticker are affected by vulnerabilities. * All versions of Admin tools are affected by vulnerabilities. * All versions of Redirecting click bouncer are affected by vulnerabilities. * All versions of Printer, e-mail and PDF versions are affected by vulnerabilities. Drupal core is not affected. If you do not use one of the contributed modules listed above, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Users of these modules are encouraged to disable the modules and search for similar alternatives. Users of the module who wish to take over maintainership should post patches to the issue queue to fix the security issues and request maintenance following the Unsupported project process [14]. -------- REPORTED BY --------------------------------------------------------- * Content Lock issue reported by Charlie Gordon [15] * Ubercart Bulk Stock Updater issue reported by Peter Boden [16] * Ubercart Payflow Link issue reported by Dylan Tack [17] of the Drupal Security Team * ticketyboo News Ticker issue reported by Sascha Grossenbacher [18] * Admintools issue reported by Ivo Van Geertruyen [19] of the Drupal Security Team * Redirecting click bouncer issue reported by John T. Haller -------- FIXED BY ------------------------------------------------------------ No fixes created. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [20] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [21]. Learn more about the Drupal Security team and their policies [22], writing secure code for Drupal [23], and securing your site [24]. [1] http://drupal.org/project/content_lock [2] http://drupal.org/project/uc_bulk_stock_updater [3] http://drupal.org/project/uc_payflowlink [4] http://drupal.org/project/ticketyboo [5] http://drupal.org/project/admintools [6] http://drupal.org/project/bouncer [7] http://drupal.org/security-team/risk-levels [8] http://drupal.org/project/content_lock [9] http://drupal.org/project/uc_bulk_stock_updater [10] http://drupal.org/project/uc_payflowlink [11] http://drupal.org/project/ticketyboo [12] http://drupal.org/project/admintools [13] http://drupal.org/project/bouncer [14] http://drupal.org/node/251466 [15] http://drupal.org/user/157412 [16] http://drupal.org/user/55050 [17] http://drupal.org/user/96647 [18] http://drupal.org/user/214652 [19] http://drupal.org/user/383424 [20] http://drupal.org/user/102818 [21] http://drupal.org/contact [22] http://drupal.org/security-team [23] http://drupal.org/writing-secure-code [24] http://drupal.org/security/secure-configuration

1 0

DRUPAL-PSA-2012-001 - localizations - Cross Site Scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-PSA-2012-001 * Version: 6.x, 7.x * Date: 2012-March-07 * Security risk: Moderately critical [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This is a public service announcement regarding possible cross-site scripting risks associated with interface localizations for Drupal. Drupal has cross-site scripting prevention filters in the interface localization import code in Drupal core, however, the extent to which localization can be used to inject markup to webpages is wider, and due to Drupal's localization architecture and code reuse, we cannot tell in advance where the localized text is going to be used and how we should sanitize the translated text. When translated text is used, developers do not expect that it might cause cross-site scripting issues and therefore do not use filtering techniques when the resulting text is assembled into the output. You should be aware that Drupal's cross-site scripting prevention for interface localizations is not complete and therefore you should review the localizations imported to your site before importing them or ensure that they come from trusted sources. Even Drupal's central localization source, localize.drupal.org has configurable permission system for teams. Those teams where translations are moderated by a team of volunteers are less likely to contain any attack code. Consequently we are adding /translate interface/ to our list of advanced permissions in our Security advisories process and permissions policy [2] document. The issue also affect contributed modules like Localization update which automate localization import from localize.drupal.org and compatible servers or String overrides, which allows you to use the localization system to override English built-in text. -------- VERSIONS AFFECTED --------------------------------------------------- Multiple modules can be used to translate the interface text. Some of those are * Locale module in Drupal core. * Localization update [3] * String overrides [4] Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Given that translations strings can be harmful, you should treat them with the same skepticism that you treat modules. Get them from reputable sources or review them prior to using them. See also the project page. -------- REPORTED BY --------------------------------------------------------- * The underlying issue was reported by Justin C. Klein Keane [5] -------- FIXED BY ------------------------------------------------------------ This PSA drafted by: * Gábor Hojtsy [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/security-team/risk-levels [2] http://drupal.org/security-advisory-policy [3] http://drupal.org/project/l10n_update [4] http://drupal.org/project/stringoverrides [5] http://drupal.org/user/302225 [6] http://drupal.org/user/4166 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0