CVE-2009-3157

Vulnerability

The Calendar module for Drupal 6.x, prior to version 6.x-2.2, contains a stored cross-site scripting (XSS) vulnerability [1]. The module fails to properly escape user input when displaying titles of content types that have Date fields. A user with the “create new content types” privilege can inject arbitrary web script or HTML through the title of a content type [1].

Exploitation

An attacker must be an authenticated user who has permission to create new content types (including via the Date module’s Date Tools sub-module) [1]. The attacker creates a new content type with a crafted title that includes malicious JavaScript or HTML. When other users visit pages where the Calendar module displays the content type title, the injected script executes in their browsers. No additional privileges or user interaction beyond viewing the page is required for the payload to execute.

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim’s browser session [1]. This can lead to full administrative access if the victim is an administrator, as the attacker can steal cookies, perform actions on behalf of the user, or inject further malicious content. The vulnerability is rated moderately critical [1].

Mitigation

Upgrade to Calendar 6.x-2.2, which includes a fix adding check_plain() to sanitize output [1][2]. The release containing this fix was made available on July 29, 2009 [1]. Users who cannot upgrade should restrict the “administer content types” permission to trusted users only, but upgrading is the definitive solution.