Drupal Nodequeue Module XSS Vulnerability

[Justin Klein Keane <justin () madirish net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Author: Justin C. Klein Keane <justin () madirish net>
Vendor Response:  See below

Details of this vulnerability are also posted at the public URL
http://lampsecurity.org/drupal-nodeque-xss-vulnerability

Description of Vulnerability:
- -----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS)
written in PHP and MySQL that provides extensibility through various
third party modules. The NodeQueue module
(http://drupal.org/project/nodequeue) provides functionality for
arbitrarily grouping nodes for organizational and presentation purposes.
The NodeQueue module suffers from a cross site scripting (XSS)
vulnerability due to the fact that it does not properly sanitize
taxonomy names during display.

Systems affected:
- -----------------
Drupal 6.12 with NodeQueue 6.x-2.1 was tested and shown to be vulnerable.

Impact:
- -------
XSS vulnerabilities may expose site administrative accounts to
compromise which could lead to web server process compromise.

Mitigating factors:
- -------------------
The Node Queue must be installed and enabled. Attacker must have
'administer taxonomy' permissions in order to carry out the proof of
concept exploit detailed below. Note that the proof of concept provided
utilizes known attack vectors, other vectors may exist.

Proof of concept:
- -----------------
1. Install Drupal 6.12.
2. Install and enable the Node Queue module
3. Click on 'Administer' -> 'Taxonomy Manager'
4. Click 'Add new vocabulary'
5. Fill in "<script>alert('xss');</script>' for the 'Vocabulary name:'
textarea value
6. Enter arbitrary data for the rest of the input
7. Click 'Save'
8. Click on Administer -> Nodequeue -> 'Add taxonomy queue'
9. Observe JavaScript alert

Vendor Response:
- ----------------
Upgrade Nodequeue module to the latest version http://drupal.org/node/488092

- --

Justin C. Klein Keane
http://www.MadIrish.net
http://LAMPSecurity.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mandriva - http://enigmail.mozdev.org

iPwEAQECAAYFAkowgc0ACgkQkSlsbLsN1gCFVgcApKgf+s/JKiy5EoZmBO6zQF0e
/JqrLvUgijVrdj2Iv36dBWaJSnkDKUTm/jecxHnNSDIO0Y5mgj+QJjQ2CW6g118Z
CM4A+Ccb7ijDXu4VCspjr8QjKzRF8UzFhTuEAvyp19Hux0nx3PTi2O+ryy5x+6qE
1gFPDKJG1ZA/j9Qs+l6NCHYvanf45AVlkBOo55u36wSz634QUvHp1AmtY040Qwps
d5r2+eRIF9GedoB9VcfbUyremlskuVpsdYx1Sm4DFeyKdlzRUpe0iNHh/O7LrW6q
KqRttTOuzXzbHgmTYpA=
=A9vh
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/