[Security-news] SA-CONTRIB-2012-014 - Drupal Commerce - Cross Site Scripting (XSS)

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-014
  * Project: Drupal Commerce [1] (third-party module)
  * Version: 7.x
  * Date: 2012-January-25
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

Drupal Commerce is a flexible eCommerce framework built on Drupal 7 that lets
you construct any type of eCommerce website. Part of its flexibility lies in
its ability to render product fields into node displays through the product
reference field used to build dynamic Add to Cart forms. In Drupal Commerce
1.1 this feature was expanded to also incorporate the "extra fields" of
products, i.e. the product title and SKU.

The theme functions used to render product titles and SKUs prints those
variables to the page without properly sanitizing them first. A user with the
proper permissions could create a product that ends up in a node display
where a malicious title or SKU is rendered.

This vulnerability is mitigated by the fact that the attacker must have a
role with a product creation permission, and since Drupal Commerce 1.1, the
site must have been updated to make use of these extra fields in product
display nodes as they default to being hidden on all product displays.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Drupal Commerce version 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Drupal
Commerce [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use Drupal Commerce 7.x-1.1, upgrade to Drupal Commerce 7.x-1.2 [4]

See also the Drupal Commerce [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Ivo Van Geertruyen (mr.baileys [6]) of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * Ivo Van Geertruyen (mr.baileys [7]) of the Drupal Security Team
  * Ryan Szrama (rszrama [8]) the module maintainer

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and securing your site [12].


[1] http://drupal.org/project/commerce
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/commerce
[4] http://drupal.org/node/1417014
[5] http://drupal.org/project/commerce
[6] http://drupal.org/user/383424
[7] http://drupal.org/user/383424
[8] http://drupal.org/user/49344
[9] http://drupal.org/contact
[10] http://drupal.org/security-team
[11] http://drupal.org/writing-secure-code
[12] http://drupal.org/security/secure-configuration