Drupal CMS v7.5.x - Multiple Web Vulnerabilities

Document Title:
===============
Drupal CMS v7.5.x - Multiple Web Vulnerabilities


References (Source):
====================
Released on the german ePost Security Cup (http://www.deutschepost.de/dpag?lang=de_EN&xmlFile=link1022792_1022790)


Release Date:
=============
2011-09-17


Vulnerability Laboratory ID (VL-ID):
====================================
47


Product & Service Introduction:
===============================
Drupal is a free software package that allows an individual or a community of users to easily publish, manage and 
organize a wide variety of content on a website. Tens of thousands of people and organizations are using Drupal to 
power scores of different web sites, including

    * Community web portals
    * Discussion sites
    * Corporate web sites
    * Intranet applications
    * Personal web sites or blogs
    * Aficionado sites
    * E-commerce applications
    * Resource directories
    * Social Networking sites

The built-in functionality, combined with dozens of freely available add-on modules, will enable features such as:

    * Electronic commerce
    * Blogs
    * Collaborative authoring environments
    * Forums
    * Peer-to-peer networking
    * Newsletters
    * Podcasting
    * Picture galleries
    * File uploads and downloads   ... & more!

(Copy of the Vendor Homepage: http://drupal.org/about)


Abstract Advisory Information:
==============================
Vulnerability-Lab team discovered multiple web vulnerabilities on the famous Drupal Content Management System.


Vulnerability Disclosure Timeline:
==================================
2011-02-07:	Vendor Notification
2011-04-09:	Vendor Response/Feedback
2011-07-01:	Vendor Fix/Patch
2011-09-18:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Multiple persistent input validation errors are detected on the new Drupal CMS v7.x.
Local privileged user accounts can implement malicous persistent script codes to manipulate application content.

Vulnerable Module(s): (Persistent)
								[+] Configure
								[+] Permission
								[+] Roles
								[+] Rules


Multiple non-persistent input validation errors are detected on the new Drupal CMS v7.x.
Remote attackers can hijack customer session with high required user inter action via cross site scripting as non-persistent request.

Vulnerable Module(s): (Non-Persistent)
								[+] ?q
								[+] &destination

Pictures: (All)
			    			../1.png
			   			 ../2.png
			   			 ../3.png
			   			 ../4.png
			   			 ../5.png


Proof of Concept (PoC):
=======================
Input Validation Vulnerability (Persistent) 1.1
http://demo.xxx.com/drupal2/?q=admin/user/permissions/4
http://demo.xxx.com/drupal2/?q=admin/user/roles
http://demo.xxx.com/drupal2/?q=admin/user/rules/add          		|>access|>rulez
http://demo.xxx.com/drupal2/admin/settings/actions/configure/

1.1 |> later affected files
http://demo.xxx.com/drupal2/?q=admin/user/user/create   		|>Roles|>Display
http://demo.xxx.com/drupal2/?q=admin/build/block/add    		|>Add block|>Show Block specific roles
http://demo.xxx.com/drupal2/?q=admin/build/block/configure/user/1

Input Validation Vulnerability (Non-Persistent)
http://demo.xxx.com/drupal2/?q=[IVV]&destination=admin%2Fuser%2Frules%2Fadd


Security Risk:
==============
The security risk of the persistent vulnerabilities are estimated as medium.
the security risk of the non-persistent cross site vulnerabilities are estimated as low.


Credits & Authors:
==================
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory