Description
The Mass Contact module allows privileged users to send mass email messages to groups of site users, optionally with file attachments.
In _mass_contact_process_mime_mail_attachments() (mass_contact.page.inc), attachment filenames taken from $_FILES were interpolated into translatable error messages using the ! placeholder, which inserts values raw without HTML encoding. A malicious actor with the "mass contact" permission could trigger one of these error-path messages by uploading a file whose name contains HTML or JavaScript (e.g., <script>alert(1)</script>.txt), causing the script to execute in the browser of any user who sees the message.
This vulnerability is mitigated by the fact that it requires the "send mass contact" permission and that the XSS payload is only rendered when a file upload error occurs, which an attacker must deliberately trigger.
Solution
Install the latest version.
If you use the Mass Contact module for Drupal 7, upgrade to mass_contact 7.x-1.3:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES