[Security-news] SA-CONTRIB-2012-055 - Fusion theme - Cross Site Scripting (XSS)

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-055
  * Project: Fusion [1] (third-party theme)
  * Version: 6.x
  * Date: 2012-March-28
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

Fusion is a base theme that provides a configurable grid system and modular
styling for common Drupal UI components.

The theme outputs a CSS class for the tag based on the current URL, but does
not provide sufficient filtering to prevent a Cross site scripting (XSS)
attack.

This vulnerability affects all sub-themes of Fusion.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Fusion 6.x-1.x versions prior to 6.x-1.13

Drupal core is not affected. If you do not use the contributed Fusion [3]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

If you utilize Fusion or a Fusion-based theme, you should upgrade to Fusion
6.x-1.13 [4].

  * Most Fusion sub-themes will inherit this fix.
  * If you copied code from Fusion core's template.php file into a custom
    sub-theme's template.php file you should compare your code to the changes
    made in this release to ensure the vulnerability has not been duplicated.
    In YOURTHEME_preprocess_page() look for this code:
    $vars['body_id'] = 'pid-' . strtolower(preg_replace('/[_+\/]/', '-',
    drupal_get_path_alias($_GET['q'])));

    If this code exists within your sub-theme, there are two possible
    solutions:

     1) *Recommended:* Delete the line of code. It is unnecessary in your
        sub-theme since the sub-theme will inherit this functionality from
        Fusion Core
     2) Replace the code with the following:
        $vars['body_id'] = 'pid-' .

strtolower(fusion_core_clean_css_identifier(drupal_get_path_alias($_GET['q'])));

        fusion_core_clean_css_identifier() is a function added in this
        security release of Fusion. Making this change to your sub-theme's
        code without updating Fusion core will result in a WSOD.



Also see the Fusion [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Jakub Suchy [6], of the Drupal Security Team
  * Justin Emond [7]
  * Rick Manelius [8]
  * Abhishek Nagar [9]
  * Chris Lee [10]

-------- FIXED BY  
------------------------------------------------------------

  * Jason Yergeau [11], theme co-maintainer
  * Sheena Donnelly [12], theme co-maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Derek Wright [13] of the Drupal Security Team
  * Stéphane Corlosquet [14] of the Drupal Security Team
  * Greg Knaddison [15] of the Drupal Security Team
  * David Rothstein [16] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [17].

Learn more about the Drupal Security team and their policies [18], writing
secure code for Drupal [19], and securing your site [20].


[1] http://drupal.org/project/fusion
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/fusion
[4] http://drupal.org/node/1506600
[5] http://drupal.org/project/fusion
[6] http://drupal.org/user/31977
[7] http://drupal.org/user/186334
[8] http://drupal.org/user/680072
[9] http://drupal.org/user/259737
[10] http://drupal.org/user/1117072
[11] http://drupal.org/user/162308
[12] http://drupal.org/user/380305
[13] http://drupal.org/user/46549
[14] http://drupal.org/user/52142
[15] http://drupal.org/user/36762
[16] http://drupal.org/user/124982
[17] http://drupal.org/contact
[18] http://drupal.org/security-team
[19] http://drupal.org/writing-secure-code
[20] http://drupal.org/security/secure-configuration