By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2011-046
  • Project: Echo (third-party module)
  • Version: 6.x, 7.x, 8.x
  • Date: 2011-October-05
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

Description

The Echo module generates a fully-themed Drupal page, returning the rendered page as a text string and allowing other modules to style an HTML message as if it had been generated by the live website.

The module does not properly sanitize user-supplied content, resulting in a Cross-Site Scripting (XSS) vulnerability. Additionally, the module allows arbitrary content passed via the URL to be embedded on the site, rendering the site vulnerable to phishing exploits.

Versions affected

  • Echo 6.x-1.x versions prior to 6.x-1.7.
  • Echo 7.x-1.x versions prior to 7.x-1.7.
  • Echo 8.x-1.x versions prior to 8.x-1.7.

Drupal core is not affected. If you do not use the contributed Echo module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Echo module for Drupal 6.x, upgrade to Echo 6.x-1.7.
  • If you use the Echo module for Drupal 7.x, upgrade to Echo 7.x-1.7.
  • If you use the Echo module for Drupal 8.x, upgrade to Echo 8.x-1.7.

See also the Echo project page.

Reported by

  • Francesco Placella (plach)

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x, Drupal 7.x, Drupal 8.x