Drupal Ctools/Panels XSS Vulnerability
Author: Justin C. Klein Keane <email@example.com>
Reported: October 31, 2012
CVE: None assigned yet
OSVDB: None assigned yet
Description of Vulnerability
Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL. Ctools (https://drupal.org/project/ctools) is a third party Drupal module serving as a "set of APIs and tools to improve the developer experience." The Panels module (https://drupal.org/project/panels) is a third party module, reported use on over 100,000 sites. "The Panels module allows a site administrator to create customized layouts for multiple uses. At its core it is a drag and drop content manager that lets you visually design a layout and place content within that layout." The Drupal Panels module, which depends on Ctools, manifests a persistent cross site scripting (XSS) vulnerability due to the fact that Ctools fails to sanitize node titles before display in node views handled by the Ctools page manager plugin.
Drupal 6.26 with Ctools 6.x-1.9 and Panels 6.x-3.10 was tested and shown to be vulnerable
In order to inject arbitrary script malicious users must have the ability create node content. Additionally the Panels module must be configured to override the default display of affected node types.
Proof of Concept Exploit:
Install Drupal 6.26
Enabled modules and versions:
- Administration menu 6.x-1.8
- Content 6.x-2.9
- Ctools 6.x-1.9
- Page Manager 6.x-1.9
- Color 6.26
- Comment 6.26
- Database logging 6.26
- Help 6.26
- Menu 6.26
- Taxonomy 6.26
- Update Status 6.26
- Panels Nodes 6.x-3.10
- Panels 6.x-3.10
- Go to ?q=admin/build/pages/edit/node_view
- Click 'Add new variant'
- Enter arbitrary 'Title' leave drop down to 'Panel' and check 'Selection rules' and 'Contexts' then click 'Create variant'
- Change drop down to 'Node: type' and click 'Add'
- In modal pop-up check 'Story' and click 'Save'
- Ensure 'All criteria must be passed' is radio is selected and click 'Continue'
- Ensure No contexts or relationships are being defined, so that the summary of contexts is simply:
Argument 1 Node being viewed
%node:uid --> Author UID
%node:nid --> Node ID
%node:vid --> Node revision ID
%node:title --> Node title
%node:type --> Node type
- Click 'Continue'
- Select 'Columns: 1' from Category, select only radio button and click 'Continue'
- Enter an arbitrary admin title, do not check the 'Disable Drupal blocks/regions', make sure the 'Standard' renderer radio button is selected, no 'CSS ID' or 'CSS code' are provided' and click 'Continue'
- Leave the 'Title type' to 'Manually set' and the 'Title:' field empty then click 'Create variant'
- Click 'Save'
SA-CONTRIB-2012-165 was released on November 14, 2012. Upgrading to Ctools versions 6.x-1.10 or later will address the vulnerabilities in this report.