[Security-news] SA-CONTRIB-2010-066 - FileField - Cross Site Scripting

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2010-066
  * Project: FileField (third-party module)
  * Version: 5.x, 6.x
  * Date: 2010-June-16
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

FileField module integrates with the Content Construction Kit to provide a
file upload field. It also integrates with the Views and Token modules. The
module does not sanitize some of the user-supplied data before displaying it
(for Drupal 6.x-3.x only), or before adding it to tokens (both 5.x-2.x and
6.x-3.x), leading to a Cross Site Scripting (XSS [1]) vulnerability that may
lead to a malicious user gaining full administrative access. This
vulnerability is mitigated by the fact that the attacker must be able to
create or edit content with a FileField, and the site administrator must have
configured a vulnerable display format ('Path to File' or 'URL to File') or
be using token containing the filename, filepath, or description.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * FileField module for Drupal 5.x versions prior to 5.x-2.5
  * FileField module for Drupal 6.x versions prior to 6.x-3.4

Drupal core is not affected. If you do not use the contributed FileField [2]
module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version:
  * If you use the FileField module for Drupal 5.x upgrade to FileField
    5.x-2.5 [3]
  * If you use the FileField module for Drupal 6.x upgrade to FileField
    6.x-3.4 [4]

See also the FileField project page [5].
-------- REPORTED BY  
---------------------------------------------------------

  * Justin Klein Keane [6]
  * Peter Wolanin [7] of the Drupal security team

-------- FIXED BY  
------------------------------------------------------------

  * Peter Wolanin [8] of the Drupal security team
  * Justin Klein Keane [9]
  * Nathan Haug [10], the module maintainer

-------- CONTACT  
-------------------------------------------------------------

The Drupal security team [11] can be reached at security at drupal.org or via
the form at http://drupal.org/contact.

[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/project/filefield
[3] http://drupal.org/node/829790
[4] http://drupal.org/node/829754
[5] http://drupal.org/project/filefield
[6] http://drupal.org/user/302225
[7] http://drupal.org/user/49851
[8] http://drupal.org/user/49851
[9] http://drupal.org/user/302225
[10] http://drupal.org/user/35821
[11] http://drupal.org/security-team