[Security-news] SA-CONTRIB-2010-066 - FileField - Cross Site Scripting
securi...@drupal.org
* Project: FileField (third-party module)
* Version: 5.x, 6.x
* Date: 2010-June-16
* Security risk: Moderately critical
* Exploitable from: Remote
* Vulnerability: Cross Site Scripting
-------- DESCRIPTION
---------------------------------------------------------
FileField module integrates with the Content Construction Kit to provide a
file upload field. It also integrates with the Views and Token modules. The
module does not sanitize some of the user-supplied data before displaying it
(for Drupal 6.x-3.x only), or before adding it to tokens (both 5.x-2.x and
6.x-3.x), leading to a Cross Site Scripting (XSS [1]) vulnerability that may
lead to a malicious user gaining full administrative access. This
vulnerability is mitigated by the fact that the attacker must be able to
create or edit content with a FileField, and the site administrator must have
configured a vulnerable display format ('Path to File' or 'URL to File') or
be using token containing the filename, filepath, or description.
-------- VERSIONS AFFECTED
---------------------------------------------------
* FileField module for Drupal 5.x versions prior to 5.x-2.5
* FileField module for Drupal 6.x versions prior to 6.x-3.4
Drupal core is not affected. If you do not use the contributed FileField [2]
module, there is nothing you need to do.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you use the FileField module for Drupal 5.x upgrade to FileField
5.x-2.5 [3]
* If you use the FileField module for Drupal 6.x upgrade to FileField
6.x-3.4 [4]
See also the FileField project page [5].
-------- REPORTED BY
---------------------------------------------------------
* Justin Klein Keane [6]
* Peter Wolanin [7] of the Drupal security team
-------- FIXED BY
------------------------------------------------------------
* Peter Wolanin [8] of the Drupal security team
* Justin Klein Keane [9]
* Nathan Haug [10], the module maintainer
-------- CONTACT
-------------------------------------------------------------
The Drupal security team [11] can be reached at security at drupal.org or via
the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/project/filefield
[3] http://drupal.org/node/829790
[4] http://drupal.org/node/829754
[5] http://drupal.org/project/filefield
[6] http://drupal.org/user/302225
[7] http://drupal.org/user/49851
[8] http://drupal.org/user/49851
[9] http://drupal.org/user/302225
[10] http://drupal.org/user/35821
[11] http://drupal.org/security-team
_______________________________________________
Security-news mailing list
Securi...@drupal.org
http://lists.drupal.org/mailman/listinfo/security-news