Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Details of this disclosure may be found at:
http://www.madirish.net/?article=457
CVE-2010-1584
Description of Vulnerability:
-----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL. The Drupal Context module (http://drupal.org/project/context) "allows you to manage contextual conditions and reactions for different portions of your site." The Context module contains a cross site scripting (XSS) vulnerability because it fails to sanitize block descriptions before display.
Systems affected:
-----------------
Drupal 6.16 with Context 6.x-2.0-rc3 was tested and shown to be vulnerable.
Impact
------
User could inject arbitrary scripts into pages affecting site users. This could result in administrative account compromise leading to web server process compromise.
Mitigating factors:
-------------------
In order to execute arbitrary script injection malicious users must have 'Administer blocks' permission.
Technical discussion and proof of concept:
------------------------------------------
Users with 'administer blocks' permission can insert arbitrary script in block descriptions which is rendered by the Context module at ?q=admin/build/context/X where X is the block id.
Vendor Response:
----------------
Drupal security responds that they do not coordinate security fixes for modules in release candidate designation. Vulnerability was reported to the module maintainer via the public issue queue at the direction of Drupal security.
Comments
Comment #1
Steven Jones CreditAttribution: Steven Jones commentedAs this is written in the past tense, please supply the related issue where you reported the issue.
Comment #2
Steven Jones CreditAttribution: Steven Jones commentedThanks for reporting the issue. Might be an idea to let me know about the issue via my contact form next time before the public disclosure.
Fixed in http://drupal.org/cvs?commit=365210
Comment #3
Justin_KleinKeane CreditAttribution: Justin_KleinKeane commentedHello,
sorry for any confusion. I was told by Drupal security to report this via the public issue queue. Thanks for the quick fix!
Comment #4
scor CreditAttribution: scor commentedThis is fixed in the latest release: context 6.x-2.0-rc4
Comment #5
RichardLynch CreditAttribution: RichardLynch commentedWhy would Drupal security not direct a module security issue to the private maintainer form first, with recourse to public queue second?...
Perhaps a review of procedure is in order.
Granted, it's an RC, but still...