Drupal Autocomplete Node Finder 6.x-2.9 XSS Vulnerability
18 January 2012
Description of Vulnerability:
Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL. The Drupal Autocomplete Node Finder module (https://drupal.org/project/autocomplete_node_finder) contains a persistent cross site scripting (XSS) vulnerability due to the fact that it fails to sanitize node titles before display.Systems affected:
Drupal 6.22 with Autocomplete Node Finder 6.x-2.9 was tested and shown to be vulnerableImpact
User could inject arbitrary scripts into pages affecting site users. This could result in administrative account compromise leading to web server process compromise.Mitigating factors:
In order to execute arbitrary script injection malicious users must have the ability to create nodes.Proof of Concept Exploit:
- Install and enable the Autocomplete Node Finder module
- At ?q=node/add/story create a new node with the title "<script>alert('xss');</script>" and save it
- Endable the Autocomplete Node Finder block at ?q=admin/build/block/list
- Enter 'xss' in the Autocomplete Node Finder block and click the 'Search' button to view the JavaScript alert