View online: https://drupal.org/node/2205767
* Advisory ID: DRUPAL-SA-CONTRIB-2014-023 * Project: Project Issue File Review [1] (third-party module) * Version: 6.x * Date: 2014-February-26 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
The Project Issue File Review (PIFR) module provides an abstracted client-server model and plugin API for performing distributed operations such as code review and testing, with a focus on supporting Drupal development.
Two scenarios were identified where the module does not sufficiently sanitize user provided input, exposing the 'server' component of the module to cross-site scripting vulnerabilities.
The first scenario is mitigated by the fact that an attacker must have a role with the 'manage PIFR environments' administrative permission.
The second scenario is mitigated by the fact that an attacker must be able to initiate testing of a patch specially crafted to exploit the vulnerability on the PIFR testing environment, have the testing execute successfully on a PIFR client, and have the client provide the testing results back to the PIFR server component.
As one common purpose of this module is to provide validation and testing of user-supplied patches, users of the PIFR module should always consider the 'PIFR client' component of this module as insecure and untrusted, by design. The 'PIFR client' component should always be maintained in a separate network environment, isolated from the 'PIFR server' component or other critical infrastructure.
There have been no known exploits of this vulnerability observed or reported on any servers running the PIFR module, including those within Drupal.org's automated testing environment.
-------- CVE IDENTIFIER(S) ISSUED --------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./
-------- VERSIONS AFFECTED ---------------------------------------------------
* Project_Issue_File_Review 6.x-2.x versions prior to 6.x-2.17.
Drupal core is not affected. If you do not use the contributed Project Issue File Review [4] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use the PIFR module for Drupal 6.x, upgrade to Project Issue File Review 6.x-2.17 [5]. Be sure to review and consider the associated release notes for all intermediary releases when upgrading.
Also see the Project Issue File Review [6] project page.
-------- REPORTED BY ---------------------------------------------------------
* Wim Leers [7] * Jeremy Thorson [8] the module maintainer
-------- FIXED BY ------------------------------------------------------------
* Neil Drumm [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team * Jeremy Thorson [11] the module maintainer
-------- COORDINATED BY ------------------------------------------------------
* Michael Hess [12] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13].
Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16].
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17]
[1] http://drupal.org/project/project_issue_file_review [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/project_issue_file_review [5] https://drupal.org/node/2205755 [6] http://drupal.org/project/project_issue_file_review [7] http://drupal.org/user/99777 [8] http://drupal.org/user/148199 [9] http://drupal.org/user/3064 [10] http://drupal.org/user/102818 [11] http://drupal.org/user/148199 [12] http://drupal.org/user/102818 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity