Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

Vulnerability

In Drupal 7 versions prior to 7.65, Drupal 8.6 versions prior to 8.6.13, and Drupal 8.5 versions prior to 8.5.14, the File module/subsystem contains a cross-site scripting (XSS) vulnerability. Under certain circumstances, a malicious user can upload a file that, when processed by the module, executes arbitrary JavaScript in the context of the Drupal site [2].

Exploitation

An attacker with the ability to upload files (e.g., as a user with appropriate permissions) can craft a file containing malicious script. The attacker uploads the file via the File module, and when the file is accessed or rendered by the module, the embedded script is executed in the victim's browser [2].

Impact

Successful exploitation allows the attacker to perform cross-site scripting (XSS) attacks, potentially leading to session hijacking, defacement of the site, or execution of arbitrary actions on behalf of the victim user [2].

Mitigation

Update to Drupal 7.65, Drupal 8.5.14, or Drupal 8.6.13 or later, as these versions contain the fix. No workarounds are documented in the available references [2].