Drupal Embedded Media Field Module Create Content Multiple HTML Injection Vulnerabilities

Bugtraq ID:	35131
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 28 2009 12:00AM
Updated:	May 28 2009 05:19PM
Credit:	Justin Klein Keane
Vulnerable:	Drupal Embedded Media Field 6.x-1.0
Not Vulnerable:

Drupal Embedded Media Field Module Create Content Multiple HTML Injection Vulnerabilities

The Embedded Media Field module for Drupal is prone to multiple HTML-injection vulnerabilities because the module fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Note that to exploit these issues, attackers require 'Administer content types' permissions within the Drupal application.

Embedded Media Field 6.x-1.0 is vulnerable; other versions may also be affected.
http://drupal.org/node/207891

Drupal Embedded Media Field Module Create Content Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Drupal Embedded Media Field Module Create Content Multiple HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Drupal Embedded Media Field Module Create Content Multiple HTML Injection Vulnerabilities

References:

• Drupal 6 Embedded Media Module Multiple XSS (Justin Klein Keane)
  
• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Embedded Media Field Homepage (Drupal)
  
• Insecure handling of administrator-entered text (pwolanin)
  
• SA-CORE-2009-002 Drupal core - Administer content types permission (Drupal)