CVE-2025-47705

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications. The IFrame Remove module secures sites by removing unauthorized iframes from pages; unfortunately, the filtering mechanism has an exploit.

The failure revolves around the regex expression being incomplete, thereby allowing domains such as https://.drupal.org.baddomain.com (and other variations) through the filter. The vulnerability is mitigated by the fact that users must have the Full HTML permission, which is not enabled by default.

A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

• Session hijacking
• Data theft
• Malware distribution
• Defacement or phishing, and
• Privilege escalation.

This issue affects all versions of Drupal 7 IFrame Remove  Filter equal to or lower than 7.1.5 and is patched in IFrame Remove Filter NES version 7.1.6.

‍

Details

Module Info

• Product: Drupal
• Affected code: iFrame Remove Filter module
• Affected versions: >=7.0.0 <=7.1.5
• Project page: https://drupal.org/project/iframeremove
• Fixed in:  iFrame NES 7.1.6

Vulnerability Info

This medium-severity vulnerability is found in all versions of the IFrame Remove Filter module equal to or lower than 7.1.5.

The code fails to anchor the pattern thereby allowing matches of domains that are embedded in malicious domains. Because the filter is used to identify domains that are allowed, this creates a security risk.

For instance, if example.com were the pattern:

• a URL of example.com would be allowed

a URL of malicious-example.com would partially match and also be allowed—which is an error.

‍

Addressing the Issue

Users of the affected component(s) should address this exploit in one of the following ways:

• Remove all URLs from the whitelist.
• Remove "Full HTML" format access from untrusted users.
• Use the Media module for controlled iframe embedding.
• Add CSP headers to restrict which domains can be embedded.
• However, the above may not deter determined attackers and have trade-offs. Consider signing up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍