CVE-2025-8092
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages generated by Drupal's COOKiES Consent Management module, which could execute in users' browsers. It affects all Drupal sites using COOKiES Consent Management versions before 1.2.16. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- Drupal COOKiES Consent Management module
📦 What is this software?
Cookies Consent Management by Cookies Consent Management Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full control of the Drupal site, and potentially compromise the entire server infrastructure.
Likely Case
Attackers steal user session cookies, perform unauthorized actions as authenticated users, or redirect users to malicious sites.
If Mitigated
With proper input validation and output encoding, the impact is limited to minor data leakage or UI disruption.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity and can be exploited without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.16
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-092
Restart Required: No
Instructions:
1. Log into Drupal admin panel. 2. Navigate to Extend > Update. 3. Update COOKiES Consent Management module to version 1.2.16. 4. Clear Drupal caches.
🔧 Temporary Workarounds
Disable vulnerable module
linuxTemporarily disable the COOKiES Consent Management module until patched.
drush pm-disable cookies_consent_management
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources.
🧯 If You Can't Patch
- Implement web application firewall rules to block XSS payloads
- Disable user input fields that accept HTML/JavaScript in the module configuration
🔍 How to Verify
Check if Vulnerable:
Check Drupal admin panel at Extend > Installed modules for COOKiES Consent Management version.Check Version:
drush pm-list --fields=name,version | grep cookies_consent_managementVerify Fix Applied:
Confirm module version is 1.2.16 or higher in Drupal admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with script tags to module endpoints
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests containing <script> tags or javascript: URIs to vulnerable endpoints
SIEM Query:
source="web_server_logs" AND ("<script" OR "javascript:") AND uri="*cookies*"