Description
The Antispam by CleanTalk module integrates with the CleanTalk cloud service to check form submissions (comments, registrations, contact forms) for spam, and blocks detected spam with an HTML error page.
The _cleantalk_die() function in src/CleantalkFuncs.php rendered its $message argument directly into HTML output without calling filter_xss() or any other sanitization. The message originates from the comment field of the CleanTalk cloud API response, which is an external, untrusted data source.
This vulnerability is mitigated by the fact that callers pass the message through _cleantalk_filter_response(), which applies filter_xss($str, array('a')) before the value reaches _cleantalk_die(). Exploitation therefore requires either a compromise of the CleanTalk API server or a bypass of Drupal's filter_xss() on <a> tag attributes.
Solution
Install the latest version.
If you use the Anti-Spam by CleanTalk module for Drupal 7, upgrade to cleantalk 7.x-6.2:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES