CVE-2009-1844

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Drupal 5.x before version 5.18 and 6.x before version 6.12 [1]. The first vector occurs in the HTML exports of books feature where crafted UTF-8 byte sequences, which are valid in UTF-8 but interpreted as UTF-7 by Internet Explorer 6 and 7, are not properly sanitized. This is an incomplete fix for CVE-2009-1575. The second vector affects the taxonomy module, allowing users with the 'administer taxonomy' permission to inject arbitrary HTML and script code via the help text of an arbitrary vocabulary [1].

Exploitation

For the first vector, an attacker needs a remote authenticated user account with edit permissions for pages in outlines (i.e., the ability to create or modify book content) [1]. The attacker crafts content containing UTF-8 byte sequences that IE6/7 will decode as UTF-7, bypassing Drupal's output filtering. If a victim using IE6 or IE7 views the generated HTML export of the book, the script can execute. For the second vector, the attacker must have the 'administer taxonomy' permission (a privileged role) and can then insert arbitrary script into the help text field of a vocabulary; any user viewing the vocabulary page will be affected (no browser-specific condition) [1].

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML, leading to session hijacking, credential theft, or defacement within the context of the affected Drupal site. The impact is limited to authenticated users for the first vector (requiring edit permissions) and privileged users for the second (administer taxonomy), but the resulting XSS can compromise other users [1].

Mitigation

Upgrade to Drupal 5.18 or Drupal 6.12, released on 2009-May-13 [1]. For users unable to upgrade immediately, patches are available for Drupal 5.17 (SA-CORE-2009-006-5.17.patch) and Drupal 6.11 (SA-CORE-2009-006-6.11.patch) [1]. No workaround is provided for the incomplete fix; the patch must be applied. The vulnerability is not listed on the CISA KEV.