[Security-news] SA-CONTRIB-2011-041 - Hostmaster (Aegir) - Cross Site Scripting

[security-news at drupal.org]

  * Advisory ID: SA-CONTRIB-2011-041
  * Project: Hostmaster (Aegir) [1] (third-party module)
  * Version: 6.x
  * Date: 2011-September-21
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

Hostmaster (Aegir) provides a system for managing Drupal sites.

The theme in Hostmaster, Eldir, does not sanitize the custom body classes
correctly leading to a cross site scripting (XSS) vulnerability that can be
exploited when a user is made to view a specially crafted URL. If the user is
logged into an administrative account then the script can take actions using
their permissions or disclose sensitive information to a third party.

This vulnerability is mitigated by the fact that user being attacked must be
logged into Aegir with a privileged account and tricked into visiting a
specially crafted URL.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Hostmaster (Aegir) 6.x-1.x versions prior to 6.x-1.4 [3].

Drupal core is not affected. If you do not use the contributed Hostmaster
(Aegir) [4] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Follow the upgrade instructions in the release notes for the Aegir 1.4
release which can be found at: http://community.aegirproject.org/1.4 [5]

Please note that if you have installed Aegir using the debian packages,
manual intervention is currently required, and you should read the release
notes at the above link for more information.

See also the Hostmaster (Aegir) [6] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Khawer Masood and affiliated security team

-------- FIXED BY  
------------------------------------------------------------

  * Steven Jones [7] the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Greg Knaddison (greggles) [8]

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and securing your site [12].


[1] http://drupal.org/project/hostmaster
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/node/1286402
[4] http://drupal.org/project/hostmaster
[5] http://community.aegirproject.org/1.4
[6] http://drupal.org/project/hostmaster
[7] http://drupal.org/user/99644
[8] http://drupal.org/user/36762
[9] http://drupal.org/contact
[10] http://drupal.org/security-team
[11] http://drupal.org/writing-secure-code
[12] http://drupal.org/security/secure-configuration