Tag1 D7ES Announcements

The REST API file upload endpoints validate files by extension only, so an authenticated user can store a non-image file (such as HTML containing JavaScript) with an image extension and later reference it from an image field, leading to stored cross site scripting.

The Open Atrium Notifications view template prints real names and group or team titles into an HTML title attribute without sanitization. A user who sets a crafted display name or group title can store markup that executes in the browser of anyone who views the notifications pane.

The Taxonomy File Tree module exposes menu callbacks that restore an archived folder or file, moving taxonomy terms and re-saving nodes, but it performs these changes on a plain GET request with no anti-CSRF token, so an attacker can cause a privileged user to move or restore tree elements simply by getting them to load a crafted URL.

The Open Atrium Notifications remove callback deletes a notification subscription in response to a GET request but never validates the security token that its own remove links attach. An attacker can forge a request that makes an authenticated victim remove notification subscriptions without their consent.

The Taxonomy File Tree module prints taxonomy term and folder names verbatim into HTML links and headings across its file explorer block, folder tree, and AJAX content table, allowing a low privilege group member who can create or rename a folder to store cross site scripting that executes in the browser of every user who later views the tree.

The Taxonomy File Tree module builds the cancel link on its folder deletion form by inserting the raw destination query parameter into an anchor tag, allowing an attacker to craft a URL that injects arbitrary HTML into the page (reflected cross site scripting) or that points the cancel link at an external site (open redirect) for any user who opens the crafted link.

The Open Atrium Notifications remove callback deletes a notification subscription in response to a GET request but never validates the security token that its own remove links attach. An attacker can forge a request that makes an authenticated victim remove notification subscriptions without their consent.

The Get Directions module places an unvalidated location string taken from a directions URL argument directly into the rendered directions form, allowing an attacker to craft a link that runs arbitrary JavaScript in the browser of any user who holds the getdirections access permission and follows it.

The Popup module doesn't restrict evaluation of PHP contained in popup tags, allowing any user who can submit content through a text format with the Popup filter enabled to execute arbitrary PHP code on the server.

The Popup module exposes an anonymous AHAH callback that renders the body of the targeted content without re-checking the current user's access, allowing an anonymous visitor to retrieve content they should not be able to see, such as an unpublished node.