CVE-2025-9550
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in Drupal Facets allows attackers to inject malicious scripts into web pages viewed by other users. It affects Drupal sites using the Facets module for search filtering and faceted navigation. Users with access to vulnerable Facets configurations could be targeted.
💻 Affected Systems
- Drupal Facets module
📦 What is this software?
Facets by Facets Project
Facets by Facets Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites.
Likely Case
Attackers with access to Facets configuration could inject scripts that steal user session data or perform limited malicious actions.
If Mitigated
With proper input validation and output encoding, the risk is reduced to minimal, though the vulnerability still exists in the code.
🎯 Exploit Status
Exploitation requires access to Facets configuration or user input that isn't properly sanitized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Facets 2.0.10 or Facets 3.0.1
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-100
Restart Required: No
Instructions:
1. Update the Facets module via Drupal's update manager or Composer. 2. For Facets 2.x: Update to version 2.0.10. 3. For Facets 3.x: Update to version 3.0.1. 4. Clear Drupal caches after update.
🔧 Temporary Workarounds
Input Sanitization
allImplement custom input validation and output encoding for Facets-related user inputs.
🧯 If You Can't Patch
- Disable or remove the Facets module if not essential
- Implement web application firewall rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check the Facets module version in Drupal's Extend page or via 'composer show drupal/facets'Check Version:
drush pm-list | grep facetsVerify Fix Applied:
Confirm Facets version is 2.0.10 or higher for 2.x, or 3.0.1 or higher for 3.x📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Facets configuration pages
- JavaScript payloads in URL parameters or form submissions
Network Indicators:
- Suspicious script tags in HTTP requests to Facets endpoints
SIEM Query:
web_requests WHERE url CONTAINS 'facets' AND (body CONTAINS '<script>' OR params CONTAINS 'javascript:')