-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Exploit for bespoke:
* Install and enable the Activity and Flag modules
* Add a new Flag with an arbitrary name at ?q=admin/build/flags/add
* On the resulting page (?q=admin/build/flags/add/node/[name]) enter
"<script>alert('xss');</script>" for the flag Title
* View the rendered Javascript at /?q=admin/settings/activity/flagactivity
* As above
* Alter the "Comment: Insert:" field in the "Message visible to the
"All" role" fieldgroup at ?q=admin/settings/activity/commentactivity
to insert the text "<script>alert('xss');</script>"
* Move the "Activity (All): show all recent activity" block to a
visible content region at ?q=admin/build/block
* Create a story at ?q=node/add/story
* Log out
* As anonymous user add a comment at ?q=comment/reply/X#comment-form
where X is the nid of the story from step #4
* Submit the comment to view the rendered JavaScript alert in the
Activity block or log back in to see the JavaScript at ?q=activity
Patch:
The following patch mitigates the above vulnerabilities.
- --- activity/activity.module 2009-04-26 21:45:25.000000000 -0400
+++ activity.fixed/activity.module 2012-01-26 06:34:56.014821191 -0500
@@ -311,7 +311,7 @@ function activity_module_settings(&$form
'#type' => 'checkboxes',
'#title' => t('Token types'),
'#description' => t('Select the token types that you wish to
record activity from.'),
- - '#options' => $info['types'],
+ '#options' => array_map("filter_xss", $info['types']),
'#default_value' => variable_get($module .'_token_types',
array_keys($info['types'])),
'#attributes' => array('class' => 'activity-token-types'),
);
@@ -350,7 +350,7 @@ function activity_module_settings(&$form
if (count($types) > 1) {
$form[$module][$role_name][$type_name] = array(
'#type' => 'fieldset',
- - '#title' => t($type),
+ '#title' => filter_xss(t($type)),
'#collapsible' => TRUE,
'#collapsed' => TRUE,
);
@@ -1034,7 +1034,7 @@ function activity_token_replace($activit
activity_invoke_activityapi($activity, 'render');
$message = token_replace($pattern, $module, $data);
$message = token_replace($message, 'activity', $data);
- - return $message;
+ return filter_xss($message);
}
}
Justin Klein Keane
http://www.MadIrish.net
