############################################################# # # COMPASS SECURITY ADVISORY http://www.csnc.ch/ # ############################################################# # # CVE ID : CVE-2013-1393 # CSNC ID: CSNC-2013-002 # Product: Drupal CurvyCorners # Vendor: Drupal # Subject: Cross-site Scripting - XSS # Risk: High # Effect: Remotely exploitable # Author: Stephan Rickauer (stephan.rickauer _at_ csnc.ch) # Date: January 23rd 2013 # ############################################################# Introduction: ------------- Compass Security discovered a web application security flaw in the CurvyCorners module of the Drupal CMS. Vulnerable: ----------- All CurvyCorners 6.x-1.x versions. All CurvyCorners 7.x-1.x versions. Not vulnerable: --------------- unknown Fix/Patches: ------------ If you use the CurvyCorners module, uninstall the module - there is no patch available to fix this issue. The module is no longer supported. Description: ------------ The CurvyCorners module enables you to create rounded corners on HTML block elements. The module doesn't sufficiently filter user entered text when being displayed. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer curvycorners". Exploiting this vulnerability will lead to so-called cross-site scripting (XSS) and allows the impersonation of logged-in Drupal users. Milestones: ----------- December 14th 2012 Vulnerability discovered December 14th 2012 Vendor contact established December 14th 2012 Vendor acknowledged issue January 17th 2013 CVE ID assigned by MITRE January 23rd 2013 Public release of advisory by vendor References: ----------- XSS reference: http://en.wikipedia.org/wiki/Cross-site_scripting Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include HTML code and client-side scripts. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Recently, vulnerabilities of this kind have been exploited to craft powerful phishing attacks and browser exploits. Drupal SA-CONTRIB-2013-008: http://drupal.org/node/1896718