SA-CONTRIB-2012-149 - Hostip - Cross Site Scripting (XSS)

Hostip enables you to query the <http://www.hostip.info/&gt; API to get the country / state information based on the user’s IP address or a specific IP passed to it. The module fails to sanitize data retrieved from an untrusted third party source, thereby exposing an arbitrary script injection vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have either gained access to that third party source or use techniques such as DNS spoofing in order to inject malicious data.

CVE: CVE-2012-5540

Versions affected

• Hostip 6.x-2.x versions prior to 6.x-2.2.
• Hostip 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Hostip module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Hostip module for Drupal 6.x, upgrade to Hostip 6.x-1.2
• If you use the Hostip module for Drupal 7.x, upgrade to Hostip 7.x-1.2

Also see the Hostip project page.

Reported by

• Klaus Purer of the Drupal Security Team

Fixed by

• Vaibhav Jain the module maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team