Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Drupal Security Team on
- Advisory ID: DRUPAL-SA-CONTRIB-2009-022
- Project: Exif (third-party module)
- Version: 5.x, 6.x
- Date: 2009-April-29
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Cross-site scripting
Description
The Exif module enables users to display EXIF tags in images on the site.
EXIF tags are not properly filtered for HTML input, allowing users with permission to upload images to inject arbitrary code into the site using a specially crafted image. Such a cross site scripting (XSS) attack may lead to a malicious user gaining full administrative access.
Versions affected
- Exif 5.x-1.x prior to 5.x-1.2
- Exif 6.x-1.x-dev prior to April 13, 2009
Drupal core is not affected. If you do not use the contributed Exif module, there is nothing you need to do.
Solution
Install the latest version:
- If you use Exif 5.x-1.x upgrade to Exif 5.x-1.2.
- Although development versions are not supported, a fix is available; If you use Exif 6.x-1.x-dev prior to April 13, 2009, upgrade to latest Exif 6.x-1.x-dev.
See also the Exif project page.
Reported by
Jakub Suchy of the Drupal security team and Michael Hess.
Fixed by
James Gilliland and rapsli.
Contact
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
