Drupal Embedded Media 6.x-1.0 Multiple XSS

Description of Vulnerability:

Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that provides extensibility through various third party modules. The Embedded Media Field (http://drupal.org/project/emfield) module is a Content Construction Kit (CCK) module that allows for the creation of node content types that can be used for displaying video, image or audio files from a third party. The Embedded Media Field module contains several cross site scripting (XSS) vulnerabilities:

The Embedded Media Field module contains a XSS vulnerability because it does not properly sanitize the output of 'Help text', 'Custom thumbnail label', of 'Custom thumbnail description' specified when creating an Embedded Media Field content type field.

Systems affected:

Drupal 6.12 with CCK 6.x-2.2 and Embedded Media Field 6.x-1.0 was tested and shown to be vulnerable.

Impact:

XSS vulnerabilities may expose site administrative accounts to compromise which could lead to web server process compromise.

Mitigating factors:

The Embedded Media Field module must be installed. Only users who have rights to create content or administer content types are exposed to this attack vector, although these accounts are generally privileged, representing a greater risk. 'Administer content types' privilege is required to carry out the proof of concept below, although other vectors may exist.

Vendor Response:

Vendor has filed a bug report with module maintainer at http://drupal.org/node/474790.

Proof of concept:

1. Install Drupal 6.12 and CCK.
2. Install Embedded Media Field and enable all Print functionality through Administer-> Modules.
3. Adjust fields in the 'Story' content type by clicking on Administer -> Content management -> Content types, then clicking 'manage fields' next to 'Story'
4. In the 'Add' field type in an arbitrary field label and field name in the 'New field' area
5. Select 'Embedded Video' from the 'Type of data to store' drop down
6. Click the 'Save' button
7. On the resultant screen fill in "<script>alert('custom thumbnail label xss');</script>" in the "Custom thumbnail label:" text field
8. Fill in "<script>alert('custom thumbnail description xss');</script>" in the "Custom thumbnail description:" text field
9. Fill in "
10. Click the 'Save field settings' button
11. Create new content of the type by clicking the 'Create content' link then the 'Story' link
12. Observe multiple JavaScript alerts