SA-CONTRIB-2012-049 - ShareThis - Multiple Vulnerablies

The XSS issue is
CVE: CVE-2012-2076
The CSRF issue is
CVE: CVE-2012-2077

The ShareThis module allows you to display social networking tools to users.

The administration forms of the module do not properly use the Form API allowing a malicious user to inject unexpected settings, allowing for cross-site scripting attacks (XSS). Additionally, the module had an incomplete feature for updating these settings outside of the Form API which was vulnerable to a cross site request forgery attack.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer sharethis”.

Versions affected

• ShareThis 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed ShareThis module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the ShareThis module for Drupal 7.x, upgrade to ShareThis 7.x-2.3

Also see the ShareThis project page.

Reported by

• Travis Tomka

Fixed by

• Greg Knaddison of the Drupal Security Team
• Rob Loach, the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Michael Hess of the Drupal Security Team