[Security-news] SA-CONTRIB-2014-023 - Project Issue File Review - XSS

[security-news at drupal.org]

View online: https://drupal.org/node/2205767

   * Advisory ID: DRUPAL-SA-CONTRIB-2014-023
   * Project: Project Issue File Review [1] (third-party module)
   * Version: 6.x
   * Date: 2014-February-26
   * Security risk: Moderately critical [2]
   * Exploitable from: Remote
   * Vulnerability: Cross Site Scripting

-------- DESCRIPTION
---------------------------------------------------------

The Project Issue File Review (PIFR) module provides an abstracted
client-server model and plugin API for performing distributed operations such
as code review and testing, with a focus on supporting Drupal development.

Two scenarios were identified where the module does not sufficiently sanitize
user provided input, exposing the 'server' component of the module to
cross-site scripting vulnerabilities.

The first scenario is mitigated by the fact that an attacker must have a role
with the 'manage PIFR environments' administrative permission.

The second scenario is mitigated by the fact that an attacker must be able to
initiate testing of a patch specially crafted to exploit the vulnerability on
the PIFR testing environment, have the testing execute successfully on a PIFR
client, and have the client provide the testing results back to the PIFR
server component.

As one common purpose of this module is to provide validation and testing of
user-supplied patches, users of the PIFR module should always consider the
'PIFR client' component of this module as insecure and untrusted, by design.
The 'PIFR client' component should always be maintained in a separate network
environment, isolated from the 'PIFR server' component or other critical
infrastructure.

There have been no known exploits of this vulnerability observed or reported
on any servers running the PIFR module, including those within Drupal.org's
automated testing environment.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Project_Issue_File_Review 6.x-2.x versions prior to 6.x-2.17.

Drupal core is not affected. If you do not use the contributed Project Issue
File Review [4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the PIFR module for Drupal 6.x, upgrade to Project Issue File
     Review 6.x-2.17 [5].  Be sure to review and consider the associated
     release notes for all intermediary releases when upgrading.

Also see the Project Issue File Review [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Wim Leers [7]
   * Jeremy Thorson [8] the module maintainer

-------- FIXED BY
------------------------------------------------------------

   * Neil Drumm [9] of the Drupal Security Team
   * Michael Hess [10] of the Drupal Security Team
   * Jeremy Thorson [11] the module maintainer

-------- COORDINATED BY
------------------------------------------------------

   * Michael Hess [12] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [13].

Learn more about the Drupal Security team and their policies [14], writing
secure code for Drupal [15], and securing your site [16].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [17]


[1] http://drupal.org/project/project_issue_file_review
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/project_issue_file_review
[5] https://drupal.org/node/2205755
[6] http://drupal.org/project/project_issue_file_review
[7] http://drupal.org/user/99777
[8] http://drupal.org/user/148199
[9] http://drupal.org/user/3064
[10] http://drupal.org/user/102818
[11] http://drupal.org/user/148199
[12] http://drupal.org/user/102818
[13] http://drupal.org/contact
[14] http://drupal.org/security-team
[15] http://drupal.org/writing-secure-code
[16] http://drupal.org/security/secure-configuration
[17] https://twitter.com/drupalsecurity