Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Vulnerability

Description The Drupal Ignition Error Pages module, which renders error pages using the Ignition package, contains a cross-site scripting (XSS) vulnerability due to insufficient input filtering. The module disables certain Drupal core code and fails to properly neutralize input during web page generation, allowing an attacker to inject arbitrary HTML or JavaScript [1][2].

Exploitation

Conditions Exploitation requires the module to be enabled and an attacker to be able to inject crafted input into error pages. The vulnerability is partially mitigated because the module is intended for development use only and not recommended for production environments, limiting the attack surface in typical deployments [2].

Impact

Successful exploitation permits a reflected or stored XSS attack, enabling an attacker to execute arbitrary script in the context of a user's browser. This could lead to session hijacking, defacement, or other actions performed on behalf of the victim [1][2].

Mitigation

The issue affects all versions from 0.0.0 before 1.0.4. The fix is included in Ignition Error Pages version 1.0.4 [2]. Site owners should update to the latest version and avoid using this module on production environments.