Imagefield Assist module has very weak hook_filter() implementation, allowing an (unprivileged) attacker to insert arbitrary (javascript) code in posts. I did not report it to the security team because the module doesn't have a stable release.

Proof of concept:
[imagefield_assist|fid=165|title=|desc=|link=none|lightbox=true|align=left|width=100" onclick="javascript:alert('Test')" height="100|preset=ifa_crop_100_75]

This example generates image with onclick event handler. Note: this is just an example. There could be more vulnerabilities in the filter implementation, because the code quality seems to be poor. I tested dev version but beta3 could be vulnerable too.

Comments

franz’s picture

franz
any
Location Montréal
commented

If this affects beta version, then this shouldn't get public like that. Could you please provide a patch at least?

crea’s picture

crea commented

Betas are not supported by Drupal security team, and considered as unsafe by default, so the best way is to publicly disclose the vulnerability.
I do not think a simple patch would suffice: rather, this module needs deep security inspection. Judging by the code, I would not patch and use the module myself anyway: it seems to contain too much of legacy code - using frames, no usage of jQuery, etc.

lourenzo’s picture

lourenzo commented
Assigned: Unassigned » lourenzo
Status: Active » Needs work

We're going to rebuild the filter part, in order to check and avoid this type of injection