[IT-SecNots] [Security-news] SA-CONTRIB-2011-008 - Chatroom - Cross Site Scripting (XSS) and Cross Site Request Forgery

[security-news AT drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2011-008
  * Project: Chatroom (third-party module)
  * Version: 6.x
  * Date: 2011-February-02
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting and Cross Site Request Forgery

-------- DESCRIPTION  
---------------------------------------------------------

The Chatroom module provides real-time chat capabilities to Drupal.

.... Vulnerability: Cross Site Scripting

The module does not properly escape the contents of chat messages in pages
listing the chats contained in a chatroom, leading to a Cross Site Scripting
(XSS [1]) vulnerability. Any user with permission to view chatroom summary
pages is vulnerable to attack.

.... Vulnerability: Cross Site Request Forgery

The module does not properly check for valid form tokens, leading to a Cross
Site Request Forgery(XSS [2]) vulnerability. Users with administrative
privileges are vulnerable to replay attacks.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Chatroom module for Drupal 6.x versions prior to 6.x-2.13.

Drupal core is not affected. If you do not use the contributed Chatroom [3]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * Upgrade to Chatroom 6.x-2.13 [4]

See also the Chatroom project page [5].

-------- REPORTED BY  
---------------------------------------------------------

  * XSS reported by Steffen Schüssler [6]
  * CSRF reported by Greg Knaddison [7] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * Justin Randell [8], module maintainer

-------- CONTACT  
-------------------------------------------------------------

The Drupal security team [9] can be reached at security at drupal.org [10] or
via the form at http://drupal.org/contact [11].


[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://en.wikipedia.org/wiki/Cross-site_request_forgery
[3] http://drupal.org/project/chatroom
[4] http://drupal.org/node/1045716
[5] http://drupal.org/project/chatroom
[6] http://drupal.org/user/107190
[7] http://drupal.org/user/36762
[8] http://drupal.org/user/38580
[9] http://drupal.org/security-team
[10] http://drupal.org
[11] http://drupal.org/contact

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
http://lists.drupal.org/mailman/listinfo/security-news