CVE-2025-13979
📋 TL;DR
This vulnerability in Drupal Mini site allows attackers with certain privileges to inject malicious scripts that execute when other users view affected pages. It affects all Drupal Mini site installations from initial versions up to 3.0.2. The stored XSS can lead to session hijacking, data theft, or further system compromise.
💻 Affected Systems
- Drupal Mini site
📦 What is this software?
Mini Site by Salsa.digital
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, take over the site, install backdoors, or pivot to attack other systems in the network.
Likely Case
Attackers with contributor-level access inject malicious scripts that steal user session cookies or redirect users to phishing sites when viewing affected content.
If Mitigated
With proper input validation and output escaping, the XSS payloads would be neutralized before reaching users.
🎯 Exploit Status
Exploitation requires authenticated user with content creation/editing privileges. XSS payloads are well-documented and easy to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.2
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-117
Restart Required: No
Instructions:
1. Backup your Drupal site. 2. Update the Mini site module to version 3.0.2 via Drupal's update manager or composer. 3. Clear Drupal caches. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict content editing permissions
allTemporarily remove content creation/editing permissions from non-essential users until patching is complete.
Enable Content Security Policy
allImplement CSP headers to restrict script execution sources and mitigate XSS impact.
🧯 If You Can't Patch
- Implement web application firewall rules to block common XSS payload patterns
- Enable Drupal's built-in XSS filtering and ensure all user input is properly sanitized
🔍 How to Verify
Check if Vulnerable:
Check the Mini site module version in Drupal's Extend page or via 'drush pm-list | grep mini_site'Check Version:
drush pm-list --fields=name,version --format=json | grep -A2 -B2 "mini_site"Verify Fix Applied:
Confirm Mini site module version is 3.0.2 or higher and test content creation with XSS payloads to ensure they're sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual content edits by users, especially with script tags or JavaScript in content
- Multiple failed XSS attempts in web server logs
Network Indicators:
- Outbound connections to suspicious domains from the Drupal server following content views
SIEM Query:
source="drupal.log" AND ("script" OR "javascript:" OR "onload=" OR "onerror=") AND event_type="content_update"