Summary
A reflected DOM-based XSS was identified in Drupal Core. This allows an attacker to craft a web-page which, when accessed by an authenticated Drupal user with content writing permissions, would send a request to either an edit node or add node endpoint on that user’s behalf. While this form would not contain valid tokens and be prevented from performing the edit or add actions, the resulting web-page would still reflect this content in the victim’s browser, and the application DOM would populate a CKEditor WYSWIG frame with the attacker’s HTML.
Product
Drupal Core before 7.72.
Drupal Core 8.x before 8.8.8.
Drupal Core 8.9.x before 8.9.1.
Drupal Core 9.0.x before 9.0.1.
Impact
This can cause malicious code to run on the victim’s browser, which can lead to the hijacking of user accounts and inject arbitrary web-content as malicious login or payment forms.
Steps to reproduce
In any vulnerable version of Drupal Core, using the Basic Page functioniality and URL rewrites are not changed, an authenticate user with permissions to add the page and use a Full HTML mode will execute:
<img data-caption=<script>alert('XSS by Checkmarx')</script>" data-entity-uuid="2" data-entity-type="1" src="x" />Expected result:
<script>alert("XSS by Checkmarx")</script>Will be loaded in the victim’s browser.
Remediation
If you are using Drupal Core before 7.72, update to 7.72 and above.
If you are using Drupal Core 8.x, update to 8.8.8 and above.
If you are using Drupal Core 8.9.x, update to 8.9.1 and above.
If you are using Drupal Core 9.0.x, update to 9.0.1 and above.
Credit
This issue was discovered and reported by:
Checkmarx Security Researcher Dor Tumarkin.
Samuel Mortenson of the Drupal Security Team.
