[Security-news] SA-CONTRIB-2013-001 - Search API - Cross Site Scripting

[security-news at drupal.org]

View online: http://drupal.org/node/1884332

  * Advisory ID: DRUPAL-SA-CONTRIB-2013-001
  * Project: Search API [1] (third-party module)
  * Version: 7.x
  * Date: 2013-January-09
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

This module enables you to build searches using a wide range of features,
data sources and backends.

The module doesn't sufficiently sanitize user input when displaying errors in
a view with certain backends, including the database backend. This enables
attackers to create a Reflected Cross Site Scripting attack by manipulating
the URL.
This is mitigated by the fact that the vulnerability only occurs with some
backends (the Solr backend, e.g., is safe) and for certain common
configurations of facets.
The module also doesn't sufficiently sanitize output field names in the admin
view.
This is mitigated by the fact that an attacker would have to have the
necessary permissions to change the field names of an indexed entity type.

-------- CVE IDENTIFIER(S) ISSUED  
--------------------------------------------

  * /A CVE identifier [3] will be requested, and added upon issuance, in
    accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Search API 7.x-1.x versions prior to 7.x-1.4.

Drupal core is not affected. If you do not use the contributed Search API [4]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Search API module for Drupal 7.x, upgrade to Search API
    7.x-1.4 [5]

Also see the Search API [6] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * XSS in Views error messages was reported by Josh Stroschein [7].
  * XSS in field names was reported by Francisco José Cruz Romanos [8].

-------- FIXED BY  
------------------------------------------------------------

  * XSS in Views error messages was fixed by Lee Rowlands [9] of the Drupal
    Security Team and Bojan Živanović [10].
  * XSS in field names was fixed by Francisco José Cruz Romanos [11].

-------- COORDINATED BY  
------------------------------------------------------

  * Lee Rowlands [12] of the Drupal Security Team
  * Greg Knaddison [13] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [14].

Learn more about the Drupal Security team and their policies [15], writing
secure code for Drupal [16], and securing your site [17].


[1] http://drupal.org/project/search_api
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/search_api
[5] http://drupal.org/node/1884076
[6] http://drupal.org/project/search_api
[7] http://drupal.org/user/2198458
[8] http://drupal.org/user/848238
[9] http://drupal.org/user/395439
[10] http://drupal.org/user/86106
[11] http://drupal.org/user/848238
[12] http://drupal.org/user/395439
[13] http://drupal.org/user/36762
[14] http://drupal.org/contact
[15] http://drupal.org/security-team
[16] http://drupal.org/writing-secure-code
[17] http://drupal.org/security/secure-configuration