Drupal cross-site scripting vulnerability
Impact
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
Source excerpt · OSVThis function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 8.4.0 before 8.4.5Ecosystem versions | 8.4.5 |
| From 7.0 before 7.57Ecosystem versions | 7.57 |
Version evidence: OSV · GHSA-585j-5449-mf5m
View original version evidence (5 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 8.4.0 before 8.4.5Ecosystem versions | 8.4.5 |
| From 7.0 before 7.57Ecosystem versions | 7.57 |
Version evidence: OSV · GHSA-585j-5449-mf5m
View original version evidence (5 explicit versions)
Original source description
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2017-6927
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml
- Source reference github.com/drupal/core
- Source reference lists.debian.org/debian-lts-announce/2018/02/msg00030.html
- Security advisory www.debian.org/security/2018/dsa-4123
- Security advisory www.drupal.org/sa-core-2018-001
- Source reference www.securityfocus.com/bid/103138