* Advisory ID: DRUPAL-SA-CONTRIB-2010-021 * Project: Webform [1] (third-party module) * Version: 6.x, 7.x * Date: 2010-May-18 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Multiple vulnerabilities

-------- DESCRIPTION ---------------------------------------------------------

Webform module enables you to create custom webform or survey nodes. These nodes typically may be created either by editorial teams or administrators. Webform does not sufficiently check directory access when a user configures an upload field. This may allow a user to upload malicious files to the server in unsafe locations but is mitigated by the fact that a properly configured will use directory access control to limit those locations. Webform also does not properly sanitize some user-submitted information leading to XSS vulnerabilities.

Most of these vulnerabilities are mitigated by the fact that an attacker must have a role with the permission "create webform content" or "administer nodes". The user must be able to create a webform node (or another node type that has been Webform-enabled) in order leverage these exploits. One vulnerability requires that a malicious user has a role that can submit a webform that accepts file uploads which is a more common scenario.

-------- VERSIONS AFFECTED ---------------------------------------------------

* 6.x-2.10 * 6.x-3.9 * 7.x-3.9

Drupal core is not affected. If you do not use the contributed Webform [3] module, there is nothing you need to do.

-------- SOLUTION ------------------------------------------------------------

Install the latest version:

* If you use the 2.10 or 3.9 versions of the module for Drupal 6.x upgrade to Webform 6.x-3.10 [4] (security fix only) or Webform 6.x-3.11 [5] (security fix and latest fixes/features), * If you use the 3.9 versions of the module for Drupal 7.x upgrade to Webform 7.x-3.10 [6] (security fix only) or Webform 7.x-3.11 [7] (security fix and latest fixes/features),

See also the Webform [8] project page.

-------- REPORTED BY ---------------------------------------------------------

* Justin Klein Keane [9] of the Drupal Security Team

-------- FIXED BY ------------------------------------------------------------

* Nathan Haug [10] the module maintainer * Justin Klein Keane [11] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION ----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12].

Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15].

[1] http://drupal.org/project/webform [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webform [4] http://drupal.org/node/1161880 [5] http://drupal.org/node/1161904 [6] http://drupal.org/node/1161882 [7] http://drupal.org/node/1161906 [8] http://drupal.org/project/webform [9] http://drupal.org/user/302225 [10] http://drupal.org/user/35821 [11] http://drupal.org/user/302225 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration