DRUPAL-CONTRIB-2023-044 The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.
Attackers can bypass Twig auto-escaping to inject scripts if the abbr_class filter is used in a theme, requiring specific theme configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2023-044?
DRUPAL-CONTRIB-2023-044 is a cross-site scripting vulnerability in drupal/webprofiler, published on 6 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.
The abbr_class Twig filter can be used to bypass the Twig auto-escape feature.
This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.
Which versions are affected by DRUPAL-CONTRIB-2023-044?
Linux distribution packages (1)
drupal/webprofiler Packagist:https://packages.drupal.org/8 | From 10.1.0 | 10.1.1 |
How do I fix DRUPAL-CONTRIB-2023-044?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2023-044 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-044 in the wild and no public exploit code.