* Advisory ID: DRUPAL-SA-CONTRIB-2012-014 * Project: Drupal Commerce [1] (third-party module) * Version: 7.x * Date: 2012-January-25 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
Drupal Commerce is a flexible eCommerce framework built on Drupal 7 that lets you construct any type of eCommerce website. Part of its flexibility lies in its ability to render product fields into node displays through the product reference field used to build dynamic Add to Cart forms. In Drupal Commerce 1.1 this feature was expanded to also incorporate the "extra fields" of products, i.e. the product title and SKU.
The theme functions used to render product titles and SKUs prints those variables to the page without properly sanitizing them first. A user with the proper permissions could create a product that ends up in a node display where a malicious title or SKU is rendered.
This vulnerability is mitigated by the fact that the attacker must have a role with a product creation permission, and since Drupal Commerce 1.1, the site must have been updated to make use of these extra fields in product display nodes as they default to being hidden on all product displays.
-------- VERSIONS AFFECTED ---------------------------------------------------
* Drupal Commerce version 7.x-1.1.
Drupal core is not affected. If you do not use the contributed Drupal Commerce [3] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use Drupal Commerce 7.x-1.1, upgrade to Drupal Commerce 7.x-1.2 [4]
See also the Drupal Commerce [5] project page.
-------- REPORTED BY ---------------------------------------------------------
* Ivo Van Geertruyen (mr.baileys [6]) of the Drupal Security Team
-------- FIXED BY ------------------------------------------------------------
* Ivo Van Geertruyen (mr.baileys [7]) of the Drupal Security Team * Ryan Szrama (rszrama [8]) the module maintainer
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9].
Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12].
[1] http://drupal.org/project/commerce [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/commerce [4] http://drupal.org/node/1417014 [5] http://drupal.org/project/commerce [6] http://drupal.org/user/383424 [7] http://drupal.org/user/383424 [8] http://drupal.org/user/49344 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration