CVE-2009-4370

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Menu module of Drupal Core 6.x, specifically in modules/menu/menu.admin.inc. The module does not properly sanitize user-supplied menu descriptions when rendering the menu administration overview page. Any authenticated user with the permission to create new menus can inject arbitrary HTML and script code via the menu description field. Drupal 6.x versions prior to 6.15 are affected; Drupal 5.x is not impacted by this particular issue [1].

Exploitation

An attacker must have an authenticated account on a Drupal 6.x site and be granted the "create new menus" permission. The attacker creates a new menu and enters malicious JavaScript or HTML into the menu description field. When a privileged user (such as an administrator) visits the menu administration overview page, the injected script executes in the context of the victim's session [1].

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML into the menu administration page. This can lead to session hijacking, privilege escalation, or administrative account takeover by, for example, tricking an admin into performing actions or stealing authentication cookies. The CVSS score is not provided, but the advisory rates the risk as "Not critical" [1].

Mitigation

Upgrade to Drupal 6.15, which was released on December 16, 2009, and includes the fix. For sites unable to upgrade immediately, the advisory provides a patch (SA-CORE-2009-009-6.14.patch) that can be applied to Drupal 6.14 as a temporary workaround [1].