[Security-news] SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2020-002

Project: SpamSpan filter [1]
Date: 2020-January-22
Security risk: *Moderately critical* 11∕25
AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Cross site scripting

Description: 
The SpamSpan module obfuscates email addresses to help prevent spambots from
collecting them.

This module contains a spamspan twig filter which doesn't sanitize the passed
HTML string.

This vulnerability is mitigated by the fact that sites must have custom twig
template files that use the SpamSpan filter on a field that an attacker could
populate. By default the SpamSpan module does not use the vulnerable twig
filter.


Solution: 
Install the latest version:

   * If you use the SpamSpan module for Drupal 8.x, upgrade to SpamSpan 
8.x-1.1
     [3]

Also see the SpamSpan filter [4] project page.

Reported By: 
   * Jeroen Tubex  [5]

Fixed By: 
   * Jeroen Tubex  [6]
   * vitalie  [7]

Coordinated By: 
   * Ben Jeavons [8] of the Drupal Security Team


[1] https://www.drupal.org/project/spamspan
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/spamspan/releases/8.x-1.1
[4] https://www.drupal.org/project/spamspan
[5] https://www.drupal.org/user/2228934
[6] https://www.drupal.org/user/2228934
[7] https://www.drupal.org/user/175134
[8] https://www.drupal.org/u/coltrane