[IT-SecNots] [Security-news] Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2021-025

Project: Admin Toolbar [1]
Date: 2021-August-25
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross Site Scripting, Access Bypass

Description: 
The /Admin Toolbar/ (admin_toolbar) module extends the default toolbar
provided by Drupal Core with various features facilitating day-to-day
editorial and administrative work.

The /Admin Toolbar Search/ sub-module of this module

  * doesn't sanitize user input in certain cases, which leads to a
    Cross-Site-Scripting (XSS) vulnerability. An attacker that can create or
    edit certain entities, entity bundles or entity types may be able to
    exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target
    users with access to the /Admin Toolbar Search/ search box, including 
site
    admins with privileged access.
  * doesn't properly check access in certain cases, which may result in an
    information disclosure vulnerability of entity type and bundle labels.

The vulnerability is mitigated by the facts, that:

  * the /Admin Toolbar Search/ sub-module must be enabled.
  * an attacker must have one of several permissions, of which at least some
    are commonly only assigned to either editors, site builders or
    administrators.
  * a targeted account must have permission to use the search box provided by
    the /Admin Toolbar Search/ sub-module.

Solution: 
Install the latest version:

  * If you use admin_toolbar 3.0.0 or later, upgrade to Admin Toolbar 3.0.2
    [3].
  * If you use admin_toolbar 8.x-2.0 or later, upgrade to Admin Toolbar
    8.x-2.5 [4].

Also see the Admin Toolbar project page [5].

Reported By: 
  * Patrick Fey [6]

Fixed By: 
  * Romain Jarraud [7]
  * Patrick Fey [8]

Coordinated By: 
  * Greg Knaddison [9] of the Drupal Security Team


[1] https://www.drupal.org/project/admin_toolbar
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/admin_toolbar/releases/3.0.2
[4] https://www.drupal.org/project/admin_toolbar/releases/8.x-2.5
[5] https://www.drupal.org/project/admin_toolbar/
[6] https://www.drupal.org/user/998680
[7] https://www.drupal.org/user/370706
[8] https://www.drupal.org/user/998680
[9] https://www.drupal.org/user/36762

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news