Mad Irish . net

Drupal 6 Actions, Triggers (Core) Module XSS Vulnerability

30 November -0001

Description of Vulnerability:

Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL. Drupal provides several "core" modules by default. The Trigger and Actions modules are two such core modules. Using the Trigger and Actions module it is possible for users with sufficient privilege to inject arbitrary script into Drupal rendered pages.

Systems affected:

Drupal 6.16 and 6.17 were tested and shown to be vulnerable

Impact

User could inject arbitrary scripts into pages affecting site users (including administrators). Script injection could result in administrative account compromise leading to web server process compromise. Client side attack through the injection of references to objects handled by third party plugins that had vulnerabilities (such as malicious Java objects or Flash movies) is also possible, which could lead to user system compromise.

Mitigating factors:

In order to execute arbitrary script injection malicious users must have 'Administer actions' permission and the affected modules must be enabled.

Technical discussion and proof of concept:

Actions and Triggers, both part of Drupal core, contains XSS vulnerabilities

Proof of concept

  1. Go to ?q=admin/settings/actions
  2. Select any option from the 'Choose an advanced action' drop down
  3. Click 'Create'
  4. Enter "<script>alert('xss');</script> in the "Description" field
  5. View ?q=admin/settings/actions to view the rendered script

Furthermore, with certain actions allow for additional script injection. Specifically the 'Display a message to a user' action can be used in conjunction with the Trigger module to display arbitrary scripts when users trigger certain actions.

Proof of concept

  1. Enable the 'Trigger' module
  2. Go to ?q=admin/settings/actions
  3. Choose "Display a message to the user..." from the "Choose an advanced action" drop down
  4. Click the 'Create' button
  5. Enter "<script>alert('message');</script>" in the "Message:" text area
  6. Click 'Save'
  7. Navigate to ?q=admin/build/trigger/node and under the "Trigger: After saving a new post" form label choose "Display a message to the user" from the "Choose an action" drop down and click the 'Assign' button
  8. Create a new page at ?q=node/add/page with arbitrary content
  9. Click 'Save' to view the JavaScript alert box from #5 above

Vendor Response

Upgrade to the latest version of Drupal. Ref SA-Core-2010-002

Tags