Home page logo

fulldisclosure logo Full Disclosure mailing list archives

[Security-news] SA-CONTRIB-2013-001 - Search API - Cross Site Scripting
From: security-news () drupal org
Date: Wed, 9 Jan 2013 22:08:07 +0000 (UTC)

View online: http://drupal.org/node/1884332

  * Advisory ID: DRUPAL-SA-CONTRIB-2013-001
  * Project: Search API [1] (third-party module)
  * Version: 7.x
  * Date: 2013-January-09
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  

This module enables you to build searches using a wide range of features,
data sources and backends.

The module doesn't sufficiently sanitize user input when displaying errors in
a view with certain backends, including the database backend. This enables
attackers to create a Reflected Cross Site Scripting attack by manipulating
the URL.
This is mitigated by the fact that the vulnerability only occurs with some
backends (the Solr backend, e.g., is safe) and for certain common
configurations of facets.
The module also doesn't sufficiently sanitize output field names in the admin
This is mitigated by the fact that an attacker would have to have the
necessary permissions to change the field names of an indexed entity type.


  * /A CVE identifier [3] will be requested, and added upon issuance, in
    accordance with Drupal Security Team processes./


  * Search API 7.x-1.x versions prior to 7.x-1.4.

Drupal core is not affected. If you do not use the contributed Search API [4]
module, there is nothing you need to do.

-------- SOLUTION  

Install the latest version:

  * If you use the Search API module for Drupal 7.x, upgrade to Search API
    7.x-1.4 [5]

Also see the Search API [6] project page.

-------- REPORTED BY  

  * XSS in Views error messages was reported by Josh Stroschein [7].
  * XSS in field names was reported by Francisco José Cruz Romanos [8].

-------- FIXED BY  

  * XSS in Views error messages was fixed by Lee Rowlands [9] of the Drupal
    Security Team and Bojan Živanović [10].
  * XSS in field names was fixed by Francisco José Cruz Romanos [11].


  * Lee Rowlands [12] of the Drupal Security Team
  * Greg Knaddison [13] of the Drupal Security Team


The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [14].

Learn more about the Drupal Security team and their policies [15], writing
secure code for Drupal [16], and securing your site [17].

[1] http://drupal.org/project/search_api
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/search_api
[5] http://drupal.org/node/1884076
[6] http://drupal.org/project/search_api
[7] http://drupal.org/user/2198458
[8] http://drupal.org/user/848238
[9] http://drupal.org/user/395439
[10] http://drupal.org/user/86106
[11] http://drupal.org/user/848238
[12] http://drupal.org/user/395439
[13] http://drupal.org/user/36762
[14] http://drupal.org/contact
[15] http://drupal.org/security-team
[16] http://drupal.org/writing-secure-code
[17] http://drupal.org/security/secure-configuration

Security-news mailing list
Security-news () drupal org
Unsubscribe at http://lists.drupal.org/mailman/listinfo/security-news
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • [Security-news] SA-CONTRIB-2013-001 - Search API - Cross Site Scripting security-news (Jan 09)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]