CVE-2017-6927

Vulnerability

The Drupal.checkPlain() JavaScript function, used to escape potentially dangerous text before outputting to HTML in Drupal 8.4.x before 8.4.5 and Drupal 7.x before 7.57, does not correctly handle all methods of injecting malicious HTML. This leads to a cross-site scripting (XSS) vulnerability when the function is used to output user-supplied data via JavaScript, as JavaScript output does not go through Twig autoescaping [2]. The PHP escaping functions are unaffected [3].

Exploitation

An attacker must be able to inject malicious HTML into a context where Drupal.checkPlain() is used to escape text before output. This can occur when user-contributed content, such as comments or form fields, is rendered via JavaScript. The attacker does not need authentication if such input points are accessible to anonymous users; however, some scenarios may require a role with permissions to post comments or similar [3]. Exploitation involves crafting a payload that bypasses the incomplete escaping to execute arbitrary JavaScript in the victim's browser [2].

Impact

Successful exploitation allows an attacker to inject arbitrary HTML and JavaScript, leading to cross-site scripting. This can result in session hijacking, cookie theft, defacement, or redirection to malicious sites, compromising the confidentiality and integrity of the affected Drupal site and its users [2][3].

Mitigation

Drupal core has released patches: upgrade to Drupal 7.57 or Drupal 8.4.5, depending on the affected version. The fix addresses the incomplete HTML escaping in Drupal.checkPlain(). No known workarounds are available for unpatched versions [3].