View online: https://www.drupal.org/sa-contrib-2021-025

Project: Admin Toolbar [1] Date: 2021-August-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting, Access Bypass

Description:  The /Admin Toolbar/ (admin_toolbar) module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work.

The /Admin Toolbar Search/ sub-module of this module

* doesn't sanitize user input in certain cases, which leads to a Cross-Site-Scripting (XSS) vulnerability. An attacker that can create or edit certain entities, entity bundles or entity types may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target users with access to the /Admin Toolbar Search/ search box, including site admins with privileged access. * doesn't properly check access in certain cases, which may result in an information disclosure vulnerability of entity type and bundle labels.

The vulnerability is mitigated by the facts, that:

* the /Admin Toolbar Search/ sub-module must be enabled. * an attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators. * a targeted account must have permission to use the search box provided by the /Admin Toolbar Search/ sub-module.

Solution:  Install the latest version:

* If you use admin_toolbar 3.0.0 or later, upgrade to Admin Toolbar 3.0.2 [3]. * If you use admin_toolbar 8.x-2.0 or later, upgrade to Admin Toolbar 8.x-2.5 [4].

Also see the Admin Toolbar project page [5].

Reported By:  * Patrick Fey [6]

Fixed By:  * Romain Jarraud [7] * Patrick Fey [8]

Coordinated By:  * Greg Knaddison [9] of the Drupal Security Team

[1] https://www.drupal.org/project/admin_toolbar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_toolbar/releases/3.0.2 [4] https://www.drupal.org/project/admin_toolbar/releases/8.x-2.5 [5] https://www.drupal.org/project/admin_toolbar/ [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/user/370706 [8] https://www.drupal.org/user/998680 [9] https://www.drupal.org/user/36762