Drupal Facebook Share Module Cross Site Scripting Vulnerability

Bugtraq ID:	48602
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 06 2011 12:00AM
Updated:	Jul 06 2011 12:00AM
Credit:	Bèr Kessels
Vulnerable:	Will Steinmetz Facebook Share 7.x-1.2 Will Steinmetz Facebook Share 6.X-1.1 Will Steinmetz Facebook Share 6.X-1.0
Not Vulnerable:	Will Steinmetz Facebook Share 7.x-1.3 Will Steinmetz Facebook Share 6.X-1.2

Drupal Facebook Share Module Cross Site Scripting Vulnerability

The Facebook Share module for Drupal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Facebook Share 6.x-1.2 and 7.x-1.3 are vulnerable.

Drupal Facebook Share Module Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more details.


Will Steinmetz Facebook Share 6.X-1.0

• Will Steinmetz facebookshare 6.x-1.2
  http://drupal.org/node/1210220

Will Steinmetz Facebook Share 6.X-1.1

• Will Steinmetz facebookshare 6.x-1.2
  http://drupal.org/node/1210220

Will Steinmetz Facebook Share 7.x-1.2

• Will Steinmetz facebookshare 7.x-1.3
  http://drupal.org/node/1210190

Drupal Facebook Share Module Cross Site Scripting Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Facebook Share Homepage (Will Steinmetz)
  
• SA-CONTRIB-2011-027 -Facebook Share - Cross Site Scripting (XSS) (Drupal)