CVE-2008-3741

Vulnerability

The private filesystem in Drupal 5.x before version 5.10 and 6.x before version 6.4 trusts the MIME type provided by the web browser for uploaded files [1]. This design flaw allows remote authenticated users with file upload permissions to bypass intended content-type restrictions by manipulating the MIME type sent during the upload process [2]. The vulnerability affects sites using Drupal's private file handling scheme.

Exploitation

An authenticated user with the ability to upload files to the private filesystem can craft an HTTP request that sends a manipulated MIME type (e.g., text/html instead of image/png) for a file containing arbitrary web script or HTML [1]. The attacker then needs to entice another user (potentially with higher privileges) into viewing the uploaded file, which, when served by Drupal, will present the attacker-supplied MIME type and cause the browser to interpret the file content as HTML or script [2].

Impact

Successful exploitation leads to cross-site scripting (XSS) in the context of the Drupal site [1][2]. An attacker can execute arbitrary web script or HTML in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive data within the Drupal application's security context [2].

Mitigation

Drupal has addressed this vulnerability in versions 5.10 and 6.4, released on August 13, 2008 [1]. Site administrators should upgrade to the latest available Drupal 5.x or 6.x release. No workaround is documented for sites that cannot immediately upgrade, and the vulnerability is not listed on the CISA KEV.