Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Drupal 6 Content Access Module XSS
From: Justin Klein Keane <justin () madirish net>
Date: Tue, 26 May 2009 16:55:35 -0400

Hash: SHA1

Details of this disclosure have been posted at

Vendor Notified: 05/19/2009

Description of Vulnerability:
- -----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS)
written in PHP and MySQL that provides extensibility through hundreds of
third party modules. The Content Access Module
(http://drupal.org/project/content_access) suffers from a cross site
scripting vulnerability because it does not sanitize role names before
displaying them on the 'Access Control' screen of managed content types.
This vulnerability is exacerbated by the fact that Drupal 6.12 core does
not perform input validation on role names as they are being created.
This can lead to a situation where users administering role based access
controls of content types could be exposed to malicious HTML content.

Systems affected:
- -----------------
Drupal 6.12 with Content Access 6.x-1.1 was tested and shown to be

- ------
Authenticated users could be exposed to XSS attacks when administering
content access. Users with this responsibility are generally site
administrators. Cross site scripting attacks against administrators
could lead to full web server process compromise.

Mitigating factors:
- -------------------
In order to carry out the exploit described below the attacker must be
able to inject malicious content into role names, which is possible for
authenticated users with the 'administer permissions' permission. Other
attack vectors may exist that do not require these restricted permissions.

Proof of concept:
- -----------------
1. Install Drupal 6.12 and Content Access 6.x-1.1
2. Click Administer -> User management -> Roles
3. Enter "<script>alert('xss');</script>" in the "Name" textarea
4. Click the "Add Role" button
5. Observe JavaScript alert
6. Click on Administer -> Content Types
7. Click on 'edit' next to any content type
8. Click on 'Access control' link
9. Observe the JavaScript alert multiple times

Vendor Response
- ---------------
Drupal security was notified of this vulnerability on 5/19/2009. Vendor
has declined to issue an official security announcement due to the
restricted access rights required to carry out the proof of concept
exploit. Vendor has filed a bug with the module maintainer at

- --

Justin C. Klein Keane
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mandriva - http://enigmail.mozdev.org


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Drupal 6 Content Access Module XSS Justin Klein Keane (May 26)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]