SA-CONTRIB-2014-034 - Custom Search - Cross Site Scripting

The Custom Search module alters the default search box to provide additional search filtering options and control.

Custom Search contains a persistent cross-site scripting (XSS) vulnerability due to the fact that it fails to sanitize filter labels before display.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer custom search.”

CVE identifier(s) issued

• CVE-2014-7870

Versions affected

• Custom Search 6.x-1.x versions prior to 6.x-1.12.
• Custom Search 7.x-1.x versions prior to 7.x-1.14.

Drupal core is not affected. If you do not use the contributed Custom Search module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Custom Search module for Drupal 6.x, upgrade to Custom Search 6.x-1.12
• If you use the Custom Search module for Drupal 7.x, upgrade to Custom Search 7.x-1.14

Also see the Custom Search project page.

Reported by

• Justin C. Klein Keane

Fixed by

• Justin C. Klein Keane
• Jérôme Danthinne, module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team