When a Security Vulnerability is Just a Bug - Drupal Content Access XSS

greggles — Wed, 27 May 2009 14:43:14 +0000

If you pay close attention you may have noticed a recent disclosure of an XSS vulnerability in the Content Access module.

This report comes from a system administrator and security researcher at a fine university and contains a section titled Vendor Response:

Drupal security [team] was notified of this vulnerability on 5/19/2009. Vendor
has declined to issue an official security announcement due to the
restricted access rights required to carry out the proof of concept
exploit. Vendor has filed a bug with the module maintainer at
http://drupal.org/node/472494.

XSS is a big deal! With XSS you can run any activity like change a user's password. A similar issue exists in Drupal core.

However, the only way to exploit this vulnerability is to edit a role or create a new role, which is only possible for people with the permission to do a lot of other really bad things on the site much more directly than XSS.

The Drupal Security team has to balance the desire to have vulnerability-free code with the desire to get every end-user updated to the most recent code. If there are dozens of new vulnerability reports and releases of core/modules all the time end users will start to ignore them - particularly when they are for things like this which aren't the most important concern within this scenario.

Is that logic sound? Do we really have a noise/upgrade/"useless release" problem? Let's look at the numbers.

How quickly do Drupal site maintainers upgrade?

So, are we doing a good job of supporting people and getting them to upgrade their site and modules?

Sadly people are still very slow to upgrade. Screaming louder about security holes isn't going to help.

There are lots of things we can do here. I've heard complaints that upgrading is too hard - it's too easy to break your site in the process. I've also heard complaints that "Well, I upgraded and then 2 weeks later a new release came out. So now I wait 2 weeks after every release to make sure I only have to do it once." I've also heard "there are so many releases and I don't understand them, so I just upgrade my sites periodically."

Dang.

So, as bullet points of what we can do

Make upgrading as easy as possible (without sacrificing security...)
Reduce unnecessary noise and confusion around SA
Only make an SA/Release when it's absolutely necessary

What else? Why don't you upgrade your sites? What could Drupal or the security team do to make you more likely to upgrade?

Cracking Drupal - Cross Site Scripting

When a Security Vulnerability is Just a Bug - Drupal Content Access XSS

How quickly do Drupal site maintainers upgrade?