CVE-2024-13247
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages generated by Drupal Coffee module, which could execute in users' browsers. It affects all Drupal sites using Coffee module versions before 1.4.0. The vulnerability enables cross-site scripting attacks against users who view affected pages.
💻 Affected Systems
- Drupal Coffee module
📦 What is this software?
Coffee by Coffee Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or deface the website.
Likely Case
Attackers inject malicious scripts that steal user session tokens or credentials when users visit compromised pages.
If Mitigated
With proper input validation and output encoding, the risk is limited to potential data leakage from unsanitized inputs.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity. The advisory suggests the vulnerability is in input handling during web page generation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.0
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-011
Restart Required: No
Instructions:
1. Update the Coffee module to version 1.4.0 via Drupal's update manager or Composer. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable Coffee module
allTemporarily disable the vulnerable module until patching is possible
drush pm-disable coffee
Implement Content Security Policy
allAdd CSP headers to mitigate XSS impact
🧯 If You Can't Patch
- Implement web application firewall rules to block XSS payloads
- Enable Drupal's built-in XSS protection features and ensure all user inputs are properly sanitized
🔍 How to Verify
Check if Vulnerable:
Check Coffee module version in Drupal admin at /admin/modules or via 'drush pm-list | grep coffee'Check Version:
drush pm-list --fields=name,version | grep coffeeVerify Fix Applied:
Confirm Coffee module version is 1.4.0 or higher and test input fields for proper sanitization📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with script tags or JavaScript payloads to Coffee module endpoints
- Multiple failed input validation attempts
Network Indicators:
- HTTP requests containing <script> tags or JavaScript code in parameters
- Unexpected redirects from Coffee module pages
SIEM Query:
source="drupal_access" AND (uri_path="*coffee*" AND (request_body="*<script>*" OR request_body="*javascript:*"))