Drupal Protected Node Cross Site Scripting

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Version Tested: 5.x-1.3 on Drupal 5.15  
  
The Drupal Protected Node module  
(http://drupal.org/project/protected_node) is designed to restrict  
access to nodes using passwords. When nodes are created they can be  
protected by selecting 'protected node' and specifying a password.  
Users attempting to access the node must then enter a password in order  
to access the node. Details of this vulnerability can also be found at  
http://lampsecurity.org/node/28.  
  
The Protected Node module fails to properly sanitize user input  
specified in the 'Password page info' input specified in Administer ->  
Site Configuration -> Protected Node. Users with the 'administer site  
configuration' permission can access this page.  
  
Steps to reproduce the exploit:  
  
1. Enable the Protected Node module  
2. Set permissions (Administer -> User Management) so anonymous users  
can access protected content in the protected_node module section  
3. Click Administer -> Site Configuration -> Protected node  
4. Enter the value <script>alert('xss');</script> into the 'Password  
page info' textarea  
5. Create a new piece of content  
6. In the 'Protected node' section on the content creation screen check  
the 'Node is protected' checkbox and enter a password.  
7. Save the content.  
8. Log out and view the content to trigger the JavaScript  
  
  
Technical details:  
  
This vulnerability is introduced by a failure to sanitize user input as  
it is being displayed in the protected_node_enterpassword() funciton in  
protected_node.module. Lines 272-274 prints out the user supplied text  
using the statement:  
  
$form['protected_node'] = array(  
'#value' => $info  
);  
  
The $info variable should be sainitized using check_plain() or similar  
function in order to prevent the XSS vulnerability.  
  
Drupal security (http://drupal.org/security) team and module maintainer  
have been notified.  
  
- --  
Justin C. Klein Keane  
http://www.MadIrish.net  
http://www.LAMPSecurity.org  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.7 (MingW32)  
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org  
  
iQD1AwUBSagRtJEpbGy7DdYAAQJuYwcAjhDPxL2rYb9epxZ5J55kslSVYC0tMxaR  
89AtwVC7NqXZ6fn9XH1vn71jw1qCNp6xnyNUgmlZDFmKs11Q3iTHgS5O2pWOiu8E  
SUwPqguqRlx6QgQRtsJaKnS0zAFHWWc2i/jZWeHwkucf3LgJkYcEC4T/p8rRDjp3  
wM0KdJnhbqC4/D8jSPAD3Ila8CRci9uoWwyGM6O4YtNQ/sxjtSHVC2ngmG3q2jTc  
JRZtMsmiAgyj4CxCY3cbcAEFTDowredqt0283Y8s+qOxKwXlDZMeoKpRfyGK2FO2  
IPLhieMuPdc=  
=xS7G  
-----END PGP SIGNATURE-----  
  
`