the original cloud security

CurvyCorners Cross Site Scripting

CurvyCorners Cross Site Scripting
Posted Jan 24, 2013
Authored by Stephan Rickauer | Site csnc.ch

CurvyCorners module versions 6.x-1.x and 7.x-1.x suffer from a cross site scripting vulnerability.

tags | advisory, xss
advisories | CVE-2013-1393
MD5 | 31d2dcbf263066bcf88396d8fc0ce3c0

CurvyCorners Cross Site Scripting

Change Mirror Download
#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2013-1393
# CSNC ID: CSNC-2013-002
# Product: Drupal CurvyCorners
# Vendor: Drupal
# Subject: Cross-site Scripting - XSS
# Risk: High
# Effect: Remotely exploitable
# Author: Stephan Rickauer (stephan.rickauer _at_ csnc.ch)
# Date: January 23rd 2013
#
#############################################################


Introduction:
-------------
Compass Security discovered a web application security flaw in the
CurvyCorners module of the Drupal CMS.


Vulnerable:
-----------
All CurvyCorners 6.x-1.x versions.
All CurvyCorners 7.x-1.x versions.


Not vulnerable:
---------------
unknown


Fix/Patches:
------------
If you use the CurvyCorners module, uninstall the module - there is no
patch available to fix this issue. The module is no longer supported.


Description:
------------
The CurvyCorners module enables you to create rounded corners on HTML
block elements. The module doesn't sufficiently filter user entered
text when being displayed. This vulnerability is mitigated by the fact
that an attacker must have a role with the permission "administer
curvycorners". Exploiting this vulnerability will lead to so-called
cross-site scripting (XSS) and allows the impersonation of logged-in
Drupal users.


Milestones:
-----------
December 14th 2012 Vulnerability discovered
December 14th 2012 Vendor contact established
December 14th 2012 Vendor acknowledged issue
January 17th 2013 CVE ID assigned by MITRE
January 23rd 2013 Public release of advisory by vendor


References:
-----------
XSS reference:
http://en.wikipedia.org/wiki/Cross-site_scripting
Cross-site scripting (XSS) is a type of computer security vulnerability
typically found in web applications which allow code injection by
malicious web users into the web pages viewed by other users. Examples
of such code include HTML code and client-side scripts. An exploited
cross-site scripting vulnerability can be used by attackers to bypass
access controls such as the same origin policy. Recently,
vulnerabilities of this kind have been exploited to craft powerful
phishing attacks and browser exploits.

Drupal SA-CONTRIB-2013-008:
http://drupal.org/node/1896718


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close