Project
Dynamic Background
Date
Severity
Moderately Critical
Risk Score
12/25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability
Stored Cross Site Scripting
Affected versions
<7.x-1.12, <7.x-2.1

Description

The Dynamic Background module lets administrators upload images that are used as the site background.

The module doesn't verify that an uploaded background is actually an image: `dynamic_background_admin_images_validate()` builds its `$validators` array with only `file_validate_extensions` and no content check, so a file whose contents are HTML/JavaScript but whose name ends in `.png` (or another permitted extension) passes validation and is stored at a public URL via `file_save_upload()` on the public file scheme.

This vulnerability is mitigated by the fact that exploitation requires the non-default "set dynamic backgrounds" permission and that the file is served with an image content-type, which limits direct script execution in modern browsers.

Solution

Install the latest version.

If you use the Dynamic Background module for Drupal 7, upgrade to Dynamic Background 7.x-1.12 or Dynamic Background 7.x-2.1:

Reported by

Fixed by

  • Tag1 D7ES

Coordinated by

  • Tag1 D7ES