Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via crafted data in a list of links.
Drupal websites using the Print module are vulnerable to a cross-site scripting (XSS) attack. Attackers can inject malicious scripts into the website through specially crafted links, potentially leading to account compromise, data theft, or website defacement.
Step 1: Payload Delivery: The attacker crafts a malicious URL containing a specially crafted payload within the data used to generate the list of links. This payload typically includes HTML or JavaScript code designed to execute in the victim's browser. Step 2: User Interaction: The attacker lures a victim to click on the malicious URL. This could be through phishing, social engineering, or other means. Step 3: Request Processing: The Drupal website, with the vulnerable Print module installed, processes the request and generates the list of links, including the attacker-controlled data. Step 4: Payload Execution: The victim's browser renders the generated HTML, including the attacker's injected JavaScript. The JavaScript executes within the context of the Drupal website, allowing the attacker to perform actions such as stealing cookies, redirecting the user, or defacing the website.
The vulnerability stems from insufficient input validation and output encoding within the Print module. Specifically, the module fails to properly sanitize user-supplied data used to generate the list of links. This allows attackers to inject arbitrary HTML or JavaScript code into the module's output, which is then rendered by the victim's browser. The root cause is a lack of proper input sanitization and output encoding (e.g., HTML entity encoding) of user-provided data, specifically within the function responsible for generating the list of links. The module trusts the data it receives, failing to recognize and neutralize malicious code. This allows for the execution of arbitrary JavaScript within the context of the vulnerable Drupal website.