CERT-In Vulnerability Note
CIVN-2015-0315
Multiple Vulnerabilities in various modules for Drupal
Original Issue Date:December 29, 2015
Severity Rating: HIGH
Systems Affected
Component Affected
- Block_class 7.x-2.x versions prior to 7.x-2.2.
- Open Atrium distribution 7.x-2.x versions prior to 7.x-2.51.
- Open Atrium Core module 7.x-2.x versions prior to 7.x-2.66.
- Select2 Field Widget 7.x-2.x versions prior to 7.x-2.9.
- Values 7.x-1.x versions prior to 7.x-1.2.
Overview
Multiple vulnerabilities have been reported in Drupal modules which could be exploited by an attacker to bypass certain security restrictions and conduct Cross Site Scripting (XSS) attacks.
Description
1. Cross Site Scripting Vulnerability in Block Class module
The vulnerability exists in the Block Class module, due to its inadequacy to properly scrub class names written by a malicious block class administrator. An attacker may leverage this issue to gain access to perform actions with elevated privileges which could allow the attacker to conduct cross site scripting attacks.
Note: Successful exploitation of this vulnerability requires that the attacker must have access to a session with the role that has the permission "administer block classes".
2. Arbitrary PHP code execution Vulnerability
This vulnerability exists in the value module, due to the inadequacy to properly validate permissions to import raw php code. An attacker may leverage this issue to gain access to an imported page that runs arbitrary code on an exported code block (ctools) with elevated privileges.
Note: Successful exploitation of this vulnerability requires that the attacker must have a role with the permission "import value sets" to create key|value pairs for use in list fields, webforms etc
3. Cross Site Scripting (XSS) Vulnerability
This vulnerability exists in the Open Atrium and Select2 Field Widget modules, due to improper sanitization of user input. An attacker may leverage this issue to conduct Cross Site Scripting attacks.
Solution
Apply appropriate updates as mentioned in Drupal Security Advisory
https://www.drupal.org/node/2636502
https://www.drupal.org/node/2636380
https://www.drupal.org/node/2636352
https://www.drupal.org/node/2636344
Vendor Information
Drupal
https://drupal.org/security/contrib
https://www.drupal.org/node/2636502
https://www.drupal.org/node/2636380
https://www.drupal.org/node/2636352
https://www.drupal.org/node/2636344
References
Drupal
https://www.drupal.org/node/2636352
https://www.drupal.org/node/2636344
https://drupal.org/security/contrib
https://www.drupal.org/node/2636502
https://www.drupal.org/node/2636380
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|