Drupal 8.0.0-beta14 Vendor Script Vulnerable to XSS
Sandeep Kamble <[email protected]> Tue, 6 Oct 2015 13:58:13 +0530
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration |
|---|---|
| Message-ID | <CAKgGObq5AJqmeeWnZHEQFWyCvUk=hqf5S6iqnbYRuEs9vbAACA@mail.gmail.com> |
Kk92ZXJ2aWV3KgoKUmVjZW50bHksIEkgd2FzIHBsYXlpbmcgYXJvdW5kIHdpdGggdGhlIERydXBh bCBDTVMgYXBwbGljYXRpb24gY29kZS4gRHJ1cGFsCmlzIGFuIG9wZW4gc291cmNlIENNUyBhcHBs aWNhdGlvbiB3aWRlbHkgdXNlZCBmb3IgYmxvZyBwb3N0aW5nIHB1cnBvc2UsCkZ1cnRoZXIgZGV0 YWlscywgdG8ga25vdyBtb3JlIGFib3V0IERydXBhbApoZXJlIDxodHRwczovL3d3dy5kcnVwYWwu b3JnL2RvY3VtZW50YXRpb24+LiBPcGVuIHNvdXJjZSBhcHBsaWNhdGlvbgphZHZhbnRhZ2UgYmVp bmcsIHRoZSBzb3VyY2UgY29kZSB3YXMgYXQgbXkgZGlzcG9zYWwuCgpXaGlsZSBmaWRkbGluZyBh cm91bmQgd2l0aCB0aGUgY29yZSBEcnVwYWwgVmVuZG9yIFBhY2thZ2UgSSBzdHVtYmxlZCB1cG9u IGEKdmVyeSBpbnRlcmVzdGluZyB2dWxuZXJhYmlsaXR5IG9mIFhTUy4gTm93IHRoZSBpZGVhIHdh cyB0byBzZWUgaG93IGV4YWN0bHkKYW4gYXR0YWNrZXIgY2FuIGV4cGxvaXQgdGhpcyBwYXJ0aWN1 bGFyIFhTUyB0byBpbXBhY3QgRHJ1cGFsIHVzZXJzIGF0IGxhcmdlLgpTbyBsZXQgbWUgd2FsayB5 b3UgdGhyb3VnaCB0aGUgdGVjaG5pY2FsIHByb2Nlc3Mgb2YgZGlzY292ZXJ5IGFuZCBpbXBhY3QK YXNzZXNzbWVudCBmb3IgdGhlIERydXBhbCBzb3VyY2UgY29kZSBhdWRpdCB3aGljaCBsZWFkIHRv IHRoZSBkaXNjb3Zlcnkgb2YKWFNTIHdoaWNoIGNhbiBiZSB1c2VkIHRvIGhpamFjayBkcnVwYWwg YWNjb3VudHMgb3IgdG8gcGVyZm9ybSBvdGhlcgptYWxpY2lvdXMgYWN0aXZpdHkgYnkgYW4gYXR0 YWNrZXIuCgpQb3N0IHN1Ym1pc3Npb24gYWJvdXQgdGhlIHZ1bG5lcmFiaWxpdHkgZGV0YWlscyB0 byBEcnVwYWwsIHRoZXkgYWRkZWQgZmlsZQouaHRhY2Nlc3MgcHJvdGVjdGlvbiAoc28tY2FsbGVk LWZpeCkgd2hpY2ggaGFzIGJlZW4gYWRkZWQgdG8gdGhlIHZlbmRvcuKAmXMKZGlyZWN0b3J5IHRo YXQgZW5hYmxlcyBkZW55aW5nIGFjY2VzcyB0byB0aGUgZm9sbG93aW5nIGxvY2F0aW9uLAoKTG9j YXRpb24gb2YgdnVsbmVyYWJsZSBmaWxlIGlzIDoKXGNvcmVcdmVuZG9yXGJlaGF0XG1pbmtcZHJp dmVyLXRlc3RzdWl0ZVx3ZWItZml4dHVyZXNcaXNzdWUxMzAucGhwCgpUaGUgYWJvdmUgZmlsZSBj b250YWlucyBhIFBIUCBTdXBlciBHTE9CQUwgdmFyaWFibGUgOgoqJF9TRVJWRVJb4oCYSFRUUF9S RUZFUkVS4oCZXSogd2hpY2ggZmFpbHMgdG8gc2FuaXRpemUgcmVxdWVzdGVkIGRhdGEsIHdoaWNo IGlzCnNwZWNpZmljYWxseSB2dWxuZXJhYmxlIHRvIHJlZmxlY3RlZCBjcm9zcyBzaXRlIHNjcmlw dGluZyBhdHRhY2suCgoqUmVwb3J0aW5nIERhdGUgOiAqMjl0aCBBdWcsIDIwMTUgdmlhIEJ1Z0Ny b3dkCgoKKlZ1bG5lcmFiaWxpdHkgRGV0YWlsczogKgoKVGhlIHNvdXJjZSBjb2RlIGF1ZGl0IHN0 YXJ0ZWQgd2l0aCB0aGUgdXNlIG9mIGdyZXAgY29tbWFuZC5Jbml0aWFsbHksIEkgd2FzCm1vcmUg aW5jbGluZWQgdG93YXJkcyBmaW5kaW5nIHNwZWNpZmljIHNldCBvZiBrZXl3b3JkcyBsaWtlICRf R0VULCAkX1BPU1QsCiRfQ09PS0lFLCBvciAkX1JFUVVFU1QgYXMgd2VsbCBhcyBvdGhlciB1c2Vy IHByb3ZpZGVkIGlucHV0cyB0aGF0IGNhbiBhbHNvCmJlIG9wZXJhdGVkIHdpdGggJF9GSUxFUywg JF9TRVJWRVIgb25lIGJ5IG9uZS4KClNvLCBhZnRlciBhIG51bWJlciBvZiB1bnN1Y2Nlc3NmdWwg YXR0ZW1wdHMgb2YgR1JFUCBjb21tYW5kLCBmaW5hbGx5IGdyZXAKLWkgLXIg4oCcXCRfU0VSVkVS 4oCdIGNvbW1hbmQgZGlkIHRoZSB0aGluZyBmb3IgbWUhIQoKW2ltYWdlOiBkcnVwYWxTZXJ2ZXJd CjxodHRwOi8vYmxvZy5zZWN1cmVsYXllcjcubmV0L3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE1LzA5 L2RydXBhbFNlcnZlci5wbmc+CgoqRmlndXJlIDEgOiAgZ3JlcCBjb21tYW5kIGV4ZWN1dGlvbjpS YW5kb20gb3V0cHV0IGZyb20gdGhlIGFib3ZlIGNvZGUgKgoKSGVyZSwgd2UgY2FuIHNlZSBhIG51 bWJlciBvZiByZXN1bHRzIGZyb20gb3VyIHNpbXBsZSBncmVwIGNvbW1hbmQKZXhlY3V0aW9uLiBM ZXRzIHRyeSBmb3Igc29tZSBtb3JlIGNvbWJpbmF0aW9ucyB0byBnZXQgYSBwcmVjaXNlIHJlc3Vs dCBhcwpjb21wYXJlZCB0byBvdXIgZWFybGllciByZXN1bHQuCgpCaW5nbyEhIGhlcmUgYXBwZWFy cyBzb21lIGludGVyZXN0aW5nIHN0dWZmLCB3aGVuIEkgc3RhcnRlZCBkaWdnaW5nIGRlZXBlcgpp bnRvIHRoZSBwYWdlcyB0byBsb29rIGZvciBhbiB1bi1zYW5pdGl6ZWQgZGF0YSBpbnB1dHMgZnJv bSB1c2Vycy4gQWZ0ZXIgYQp3aGlsZSBhIHNwZWNpYWxseSBjcmFmdGVkIGNvbW1hbmQsIHByb2R1 Y2VkIHRoZSBkZXNpcmVkIHZhbGlkIHJlc3VsdC4KCmdyZXAgLWkgLXIg4oCcXCRfU0VSVkVS4oCd ICogfCBncmVwIOKAnCRfR0VU4oCdIHwgZ3JlcCDigJxlY2hv4oCdIGFuZCBoZXJlIHNvbWV0aGlu ZyBpcwpmaXNoeSEhIS4KCltpbWFnZTogRHJ1cGFsRWNob10KPGh0dHA6Ly9ibG9nLnNlY3VyZWxh eWVyNy5uZXQvd3AtY29udGVudC91cGxvYWRzLzIwMTUvMDkvRHJ1cGFsRWNoby5wbmc+CgoKKkZp Z3VyZSAyIDogIEZpbmFsbHksZm91bmQgc29tZSBzdXNwaWNpb3VzIGZpbGVzIHdoaWNoIG1heSBi ZSB2dWxuZXJhYmxlLiAqCgpHaXZpbmcgbXkgc2VhcmNoIGEgZGlmZmVyZW50IGFuZ2xlIEkgc3Rh cnRlZCBsb29raW5nIGZvciB0aGUgZm9sbG93aW5nOgovY29yZS92ZW5kb3IvYmVoYXQvbWluay9k cml2ZXItdGVzdHN1aXRlL3dlYi1maXh0dXJlcy9pc3N1ZTEzMC5waHAgYW5kCmd1ZXNzIHdoYXQs IHdlIHN0dW1ibGVkIHVwb24gdGhlIGZvbGxvd2luZyBjb2RlLgoKPCFET0NUWVBFIGh0bWw+Cjxo dG1sPgo8Ym9keT4KPD9waHAKaWYgKOKAmDHigJkgPT09ICRfR0VUW+KAmHDigJldKSB7CmVjaG8g 4oCYPGEgaHJlZj3igJ1pc3N1ZTEzMC5waHA/cD0y4oCzPkdvIHRvIDI8L2E+4oCZOwp9IGVsc2Ug ewplY2hvIOKAmDxzdHJvbmc+4oCZLiRfU0VSVkVSW+KAmEhUVFBfUkVGRVJFUuKAmV0uJzwvc3Ry b25nPuKAmTsKfQo/Pgo8L2JvZHk+CgoKCltpbWFnZTogRHJ1cGFsQ2F0XQo8aHR0cDovL2Jsb2cu c2VjdXJlbGF5ZXI3Lm5ldC93cC1jb250ZW50L3VwbG9hZHMvMjAxNS8wOS9EcnVwYWxDYXQucG5n PgoKCipGaWd1cmUgMyA6ICBBdCBmaXJzdCBnbGFuY2UgdGhpcyBtaWdodCBsb29rIGxpa2UgYSBz aW1wbGUgWFNTIHRvIHlvdS4gKgoKSG93ZXZlciwgYSBjbG9zZXIgbG9vayByZXZlYWxzIHRoZSB0 cnVlIG5hdHVyZSBvZiB0aGUgYmVhc3QhIQoKU28sIGxldHMgcHJlcGFyZSBhIFBPQyB3aGljaCB3 aWxsIHJldmVhbCB0aGUgdHJ1ZSBuYXR1cmUgb2YgdGhlIGJlYXN0IDspLldlCm9ubHkgaGFkIHRv IHNlbmQgYSByZWZlcmVyIGhlYWRlciB0byB0aGUgaXNzdWUxMzAucGhwIHdpdGggYSBYU1MgcGF5 bG9hZCwKYXMgc2hvd24gaW4gdGhlIGZvbGxvd2luZyBpbWFnZS4KCltpbWFnZTogN10gPGh0dHA6 Ly9ibG9nLnNlY3VyZWxheWVyNy5uZXQvd3AtY29udGVudC91cGxvYWRzLzIwMTUvMDkvNy5wbmc+ CgoqRmlndXJlIDQgOiAgc2VuZGluZyBYU1MgcGF5bG9hZCB1c2luZyByZWZlcmVyIEhUVFAgaGVh ZGVyICoKCk9uY2UgdGhpcyByZWZlcmVyIGhlYWRlciBpcyBzZW50IHZpYSB0aGUgVVJMIDoKaHR0 cDovL2dvb2dsZS5jb208c2NyaXB0PmFsZXJ0KDEpPC9zY3JpcHQ+CnRoZW4gaXQgd2lsbCBwb3Ag b3V0IGFuIGFsZXJ0IEpTIGNvZGUgZXhlY3V0aW9uLiBJbiB0aGUgYmVsb3cgaW1hZ2UgeW91IGNh bgpzZWUgc3VjY2Vzc2Z1bCBleGVjdXRpb24gb2YgdGhlIEpTIGNvZGUuCgpbaW1hZ2U6IDZdIDxo dHRwOi8vYmxvZy5zZWN1cmVsYXllcjcubmV0L3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE1LzA5LzYu cG5nPgoKCipGaWd1cmUgNSA6IFN1Y2Nlc3NmdWwgZXhlY3V0aW9uIG9mIHRoZSBKYXZhc2NyaXB0 IGNvZGUgKgoKKkNvbmNsdXNpb24qCgpPZmZpY2lhbCBEcnVwYWwgdXBkYXRlIHJlZ2FyZGluZyB0 aGUgcGF0Y2ggZm9yIHRoaXMgdnVsbmVyYWJpbGl0eSBzZWVtcwp1bnNhdGlzZmFjdG9yeSwgc2lu Y2UgdGhleSBoYXZlIGRlY2lkZWQgdG8gdXNlIOKAnC5odGFjY2Vzc+KAnSBhcyBwYXRjaCwgd2hp Y2gKaXMgbm90IGEgcHJvcGVyIG1lY2hhbmlzbSB0byBwYXRjaCBhd2F5IHRoaXMgWFNTLCBubyBm aWx0ZXIgb3IgZW5jb2RlcnMKaGF2ZSBiZWVuIHVzZWQuSG93ZXZlcixzZXZlcmFsIG90aGVyIG1l Y2hhbmlzbXMgY2FuIGJlIHVzZWQgZm9yIHN1Y2Nlc3NmdWwKZmlsdGVyaW5nICYgZW5jb2Rpbmcg c3VjaCBhcyBIdG1sRW5jb2RlLCBIdG1sQXR0cmlidXRlRW5jb2RlLApKYXZhU2NyaXB0RW5jb2Rl IGV0Yy4KcmVmZXJlbmNlIGxpbms6Cmh0dHBzOi8vbXNkbi5taWNyb3NvZnQuY29tL2VuLXVzL2xp YnJhcnkvaGg1Njc1OTklMjh2PWNzLjk1JTI5LmFzcHgKCmh0dHBzOi8vd3d3Lm93YXNwLm9yZy9p bmRleC5waHAvWFNTXyUyOENyb3NzX1NpdGVfU2NyaXB0aW5nJTI5X1ByZXZlbnRpb25fQ2hlYXRf U2hlZXQKCuKAi1JlZmVyZW5jZSA6Cmh0dHA6Ly9ibG9nLnNlY3VyZWxheWVyNy5uZXQvY29yZS1k cnVwYWwtOC0wLTAtYmV0YTE0LXhzcy1hdHRhY2sv4oCLCgotLQrigItTYW5kZWVwIFMuIEthbWJs ZQpTZWN1cmVMYXllcjcKaHR0cDovL3NlY3VyZWxheWVyNy5uZXTigIsKCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUgRnVsbCBE aXNjbG9zdXJlIG1haWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8v ZnVsbGRpc2Nsb3N1cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1 bGxkaXNjbG9zdXJlLw==