* Advisory ID: DRUPAL-SA-CONTRIB-2009-054 * Project: Go - url redirects (third-party module) * Versions: 5.x, 6.x * Date: 2009 August 26 * Security risk: Highly Critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Go - url redirects (gotwo) module adds the option to add redirected URLs. This module was found to have multiple vulnerabilities. .... Arbitrary PHP code execution Due to improper use of the PCRE regular expression engine, users with permission to use the input filter provided by the module are able to execute arbitrary PHP code on the server. .... Cross-site scripting (XSS) User-supplied text is displayed in several places without being properly filtered, allowing malicious users to inject arbitrary HTML and script code. Such a cross site scripting [1] (XSS) attack may lead to a malicious user gaining full administrative access. .... Access bypass and cross-site request forgery Due to coding errors, users may be able to add redirects or reset redirect counters without having permission to do so. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of "Go - url redirects" for Drupal 5.x prior to 5.x-1.4 * Versions of "Go - url redirects" for Drupal 6.x prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed "Go - url redirects" module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use "Go - url redirects" for Drupal 5.x upgrade to Go - url redirects 5.x-1.4 [2] * If you use "Go - url redirects" for Drupal 6.x upgrade to Go - url redirects 6.x-1.1 [3] See also the Go - url redirects project page [4]. -------- REPORTED BY --------------------------------------------------------- John Morahan [5] of the Drupal security team Alexander Hass [6], co-maintainer of the gotwo module -------- FIXED BY ------------------------------------------------------------ Alexander Hass [7] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/560336 [3] http://drupal.org/node/560332 [4] http://drupal.org/project/gotwo [5] http://drupal.org/user/58170 [6] http://drupal.org/user/85918 [7] http://drupal.org/user/85918