Drupal OG Menu Module XSS Vulnerability

Է:

@Sebug.net   dis
վṩ()ܴй,ȫоѧ֮,Ը!1.OG Menu 6.x-2.0 XSS Vulnerability2. 3.CVE-2010-17474. 5.This disclosure has also been posted at http://madirish.net/?article=4676. 7.Description of Vulnerability:8.- -----------------------------9.Drupal (http://drupal.org) is a robust content management system (CMS)10.written in PHP and MySQL.  The Drupal OG Menu module11.(http://drupal.org/project/og_menu) "allows users to manage menus by12.Organic Groups."  The OG Menu module contains a cross site scripting13.(XSS) vulnerability due to the fact that it fails to sanitize menu14.descriptions before display.15. 16.Systems affected:17.- -----------------18.Drupal 6.16 with OG Menu 6.x-2.0 was tested and shown to be vulnerable19. 20.Impact21.- ------22.User could inject arbitrary scripts into pages affecting site users.23.This could result in administrative account compromise leading to web24.server process compromise.25. 26.Mitigating factors:27.- -------------------28.In order to execute the proof of concept described below malicious users29.must have 'Administer og menu' permission.30. 31.Proof of Concept:32.- -----------------33.1.  Install Drupal 6.16, Organic Groups module and OG Menu module34.2.  Create or view a piece of content in an organic group35.3.  Click on the 'Menu' link to view ?q=node/XX/og_menu where XX is the36.node id37.4.  Click the 'Add Menu' link to view ?q=node/XX/og_menu/add38.5.  Fill in arbitrary values for the 'Menu name' and 'Title', enter39."<script>alert('xss');</script>" in the 'Description' text area40.6.  Click the 'Save' button41.7.  View the menu at ?q=node/13/og_menu/ to observe the JavaScript alert42. 43.Patch:44.- ------------------------------------------45.Applying the following patch mitigates this issue in version 6.x-2.046. 47.- --- og_menu/og_menu.module    2010-02-09 07:33:31.000000000 -050048.+++ og_menu/og_menu.module      2010-05-06 13:26:44.080266269 -040049.@@ -333,6 +333,7 @@ function og_menu_overview_page($node) {50.   while ($menu = db_fetch_array($result)) {51.     $menu['href'] = 'node/'. $node->nid .'/og_menu/'. $menu['menu_name'];52.     $menu['localized_options'] = array();53.+    $menu['description'] = check_plain($menu['description']);54.     $content[] = $menu;55.   }56.   return theme('admin_block_content', $content);57. 58.Vendor Response:59.- ----------------60.Module has been unpublished per SA-CONTRIB-2010-073.61. 62.- -- 63.Justin C. Klein Keane64.http://www.MadIrish.net