[UNIX] Drupal XSS Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 07/23/03

  • Next message: SecuriTeam: "[NEWS] Denial of Service in XAVI X7028r DSL Wireless Router (Long GET Request)" 
    To: list@securiteam.com
Date: 23 Jul 2003 14:00:51 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security in Canada

    Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
    We welcome ISPs, system integrators and IT systems resellers
    to promote the most advanced vulnerability assessment solutions today.

    Contact us at 416-482-0038 or at canadasales@beyondsecurity.com

    - - - - - - - - -

      Drupal XSS Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.drupal.org/> Drupal is an "open-source platform and content
    management system for building dynamic web sites offering a broad range of
    features and services including user administration, publishing workflow,
    discussion capabilities, news aggregation, metadata functionalities using
    controlled vocabularies and XML publishing for content sharing purposes".
    A cross-site scripting vulnerability in the product allows remote
    attackers to hijack existing connections.

    DETAILS

    Vulnerable systems:
     * Drupal version 4.2.0

    Examples:
    http://[victim]/xxx"][script]alert(document.domain)[/script]["
    http://[victim]/node/view/666">[script]alert(document.domain)[/script]

    Replace "[]" with "<>"

    Vendor status:
    Vendor has been informed and has release patches, these are available at:
    <http://drupal.org/node/view/68> http://drupal.org/node/view/68

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:ferruh@mavituna.com> Ferruh
    Mavituna.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Denial of Service in XAVI X7028r DSL Wireless Router (Long GET Request)"

    Relevant Pages