CVE-2013-1393

[Stephan Rickauer <stephan.rickauer () csnc ch>]

#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2013-1393
# CSNC ID: CSNC-2013-002
# Product: Drupal CurvyCorners
# Vendor:  Drupal
# Subject: Cross-site Scripting - XSS
# Risk:    High
# Effect:  Remotely exploitable
# Author:  Stephan Rickauer (stephan.rickauer _at_ csnc.ch)
# Date:    January 23rd 2013
#
#############################################################


Introduction:
-------------
Compass Security discovered a web application security flaw in the
CurvyCorners module of the Drupal CMS.


Vulnerable:
-----------
All CurvyCorners 6.x-1.x versions.
All CurvyCorners 7.x-1.x versions.


Not vulnerable:
---------------
unknown


Fix/Patches:
------------
If you use the CurvyCorners module, uninstall the module - there is no
patch available to fix this issue. The module is no longer supported.


Description:
------------
The CurvyCorners module enables you to create rounded corners on HTML
block elements. The module doesn't sufficiently filter user entered
text when being displayed. This vulnerability is mitigated by the fact
that an attacker must have a role with the permission "administer
curvycorners". Exploiting this vulnerability will lead to so-called
cross-site scripting (XSS) and allows the impersonation of logged-in
Drupal users.


Milestones:
-----------
December 14th 2012  Vulnerability discovered
December 14th 2012  Vendor contact established
December 14th 2012  Vendor acknowledged issue
January  17th 2013  CVE ID assigned by MITRE
January  23rd 2013  Public release of advisory by vendor


References:
-----------
XSS reference:
http://en.wikipedia.org/wiki/Cross-site_scripting
Cross-site scripting (XSS) is a type of computer security vulnerability
typically found in web applications which allow code injection by
malicious web users into the web pages viewed by other users. Examples
of such code include HTML code and client-side scripts. An exploited
cross-site scripting vulnerability can be used by attackers to bypass
access controls such as the same origin policy. Recently,
vulnerabilities of this kind have been exploited to craft powerful
phishing attacks and browser exploits.

Drupal SA-CONTRIB-2013-008:
http://drupal.org/node/1896718

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/