SA-CONTRIB-2012-014 - Drupal Commerce - Cross Site Scripting (XSS)

CVE: CVE-2012-1639

Drupal Commerce is a flexible eCommerce framework built on Drupal 7 that lets you construct any type of eCommerce website. Part of its flexibility lies in its ability to render product fields into node displays through the product reference field used to build dynamic Add to Cart forms. In Drupal Commerce 1.1 this feature was expanded to also incorporate the “extra fields” of products, i.e. the product title and SKU.

The theme functions used to render product titles and SKUs prints those variables to the page without properly sanitizing them first. A user with the proper permissions could create a product that ends up in a node display where a malicious title or SKU is rendered.

This vulnerability is mitigated by the fact that the attacker must have a role with a product creation permission, and since Drupal Commerce 1.1, the site must have been updated to make use of these extra fields in product display nodes as they default to being hidden on all product displays.

Versions affected

• Drupal Commerce version 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Drupal Commerce module, there is nothing you need to do.

Solution

Install the latest version:

• If you use Drupal Commerce 7.x-1.1, upgrade to Drupal Commerce 7.x-1.2

See also the Drupal Commerce project page.

Reported by

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Fixed by

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
• Ryan Szrama (rszrama) the module maintainer