full-disclosure - Drupal Context Module XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4BE80561.2070301@madirish.net>
Date: Mon, 10 May 2010 09:08:49 -0400
From: "Justin C. Klein Keane" <justin@...irish.net>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Drupal Context Module XSS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Details of this disclosure may be found at:
http://www.madirish.net/?article=457

CVE-2010-1584

Description of Vulnerability:
- -----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS)
written in PHP and MySQL.  The Drupal Context module
(http://drupal.org/project/context) "allows you to manage contextual
conditions and reactions for different portions of your site."  The
Context module contains a cross site scripting (XSS) vulnerability
because it fails to sanitize block descriptions before display.

Systems affected:
- -----------------
Drupal 6.16 with Context 6.x-2.0-rc3 was tested and shown to be vulnerable.

Impact
- ------
User could inject arbitrary scripts into pages affecting site users.
This could result in administrative account compromise leading to web
server process compromise.

Mitigating factors:
- -------------------
In order to execute arbitrary script injection malicious users must have
'Administer blocks' permission.

Technical discussion and proof of concept:
- ------------------------------------------
Users with 'administer blocks' permission can insert arbitrary script in
block descriptions which is rendered by the Context module at
?q=admin/build/context/X where X is the block id.

Vendor Response:
- ----------------
Drupal security responds that they do not coordinate security fixes for
modules in release candidate designation.  Vulnerability was reported to
the module maintainer via the public issue queue at the direction of
Drupal security.

- -- 
Justin C. Klein Keane
http://www.MadIrish.net

The digital signature on this message can be confirmed
using the public key at http://www.madirish.net/gpgkey
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iPwEAQECAAYFAkvoBWEACgkQkSlsbLsN1gAsZAb9GrhJSfSKKF4hM14iBIh8TKA0
ZYwv1RihbRVWyx8V+j0yUrFhQRqBZQe2FDiBvI1fnKbHCg8aulIZvPnCQfd98kkX
C/aAS5zNOtnAcD3cRq+Wk0Ly/Cbdv+sWatpewj/7JQqvSrilNsgwEksTtwi+27MM
4p5ndYMEwhk8jZZ/GgshfG4h4JU4eB1tLFF/Peu96OYZlTPVn8qh9ZzcbmjjOiMO
mGgqCNBuNZxfpGEp4xUdeLLJUEwa88D3M+b91RRn/z15ZQ2gy1WGnquPEWWhc5bd
nyZBm4OvkFoPMBp4jRY=
=nOaL
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/