* Advisory ID: DRUPAL-SA-CONTRIB-2009-043 * Project: Image Assist (third-party module) * Version: 5.x, 6.x * Date: 2009-07-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross site scripting, Information disclosure
-------- DESCRIPTION ---------------------------------------------------------
The Image Assist module for Drupal 5.x and 6.x allows users to upload and insert inline images into posts. Two vulnerabilities and weaknesses were discovered in the contributed Image Assist module. .... Cross site scripting
The node title is treated as if it was safe text, and is not escaped before being output. A user with sufficient permissions to create image nodes could insert malicious script code into the title field. Any user with access to the Image Assist properties page or any user viewing an embedded image in a popup is vulnerable to a cross-site scripting attack. Wikipedia has more information about such cross site scripting [1] (XSS) attacks. .... Information disclosure
Some pages of the module do not properly check for required access permissions, allowing unprivileged users to view the title and body of arbitrary nodes. -------- VERSIONS AFFECTED ---------------------------------------------------
* Image Assist for Drupal 5.x-1.x before version 5.x-1.8 * Image Assist for Drupal 5.x-2.x before version 2.0-alpha4 * Image Assist for Drupal 6.x-1.x before version 6.x-1.1 * Image Assist for Drupal 6.x-2.x before version 2.0-alpha4 * Image Assist for Drupal 6.x-3.x-dev before 2009-07-15
Drupal core is not affected. If you do not use the contributed Image Assist module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------
Upgrade to the latest version: * If you currently use Image Assist 5.x-1.x upgrade to Image Assist 5.x-1.8 [2] * If you currently use Image Assist 5.x-2.x upgrade to Image Assist 5.x-2.0-alpha4 [3] * If you currently use Image Assist 6.x-1.x upgrade to Image Assist 6.x-1.1 [4] * If you currently use Image Assist 6.x-2.x upgrade to Image Assist 6.x-2.0-alpha4 [5] * If you currently use Image Assist 6.x-3.x-dev upgrade to Image Assist 6.x-3.x-dev after 2009-07-15
See also the Image Assist project page [6]. -------- REPORTED BY ---------------------------------------------------------
Stefan M. Kudwien (smk-ka) [7] -------- FIXED BY ------------------------------------------------------------
Daniel F. Kudwien (sun) [8], the project maintainer. -------- CONTACT -------------------------------------------------------------
The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Xss [2] http://drupal.org/node/520592 [3] http://drupal.org/node/520586 [4] http://drupal.org/node/520590 [5] http://drupal.org/node/520584 [6] http://drupal.org/project/img_assist [7] http://drupal.org/user/48898 [8] http://drupal.org/user/54136