full-disclosure

Open Source and information security mailing list archives

Date: Sun, 26 Apr 2015 19:01:14 -0400
From: Scott Arciszewski <scott@...iszewski.me>
To: Jouko Pynnonen <jouko@....fi>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] WordPress 4.2 stored XSS

Using MySQL column truncation to trick an XSS past their filter... clever.
I never would have thought to do that. :)

On Sun, Apr 26, 2015 at 4:13 PM, Jouko Pynnonen <jouko@....fi> wrote:

> *Overview*
> Current versions of WordPress are vulnerable to a stored XSS. An
> unauthenticated attacker can inject JavaScript in WordPress comments. The
> script is triggered when the comment is viewed.
>
> If triggered by a logged-in administrator, under default settings the
> attacker can leverage the vulnerability to execute arbitrary code on the
> server via the plugin and theme editors.
>
> Alternatively the attacker could change the administrator’s password,
> create new administrator accounts, or do whatever else the currently
> logged-in administrator can do on the target system.
>
>
>
>
> *Details*
> If the comment text is long enough, it will be truncated when inserted in
> the database. The MySQL TEXT type size limit is 64 kilobytes so the comment
> has to be quite long.
>
> The truncation results in malformed HTML generated on the page. The
> attacker can supply any attributes in the allowed HTML tags, in the same
> way as the previous stored XSS vulnerabilities affecting WordPress.
>
> The vulnerability bears a similarity to the one reported by Cedric Van
> Bockhaven in 2014 (patched this week, after 14 months). Instead of using an
> invalid UTF-8 character to truncate the comment, this time an excessively
> long comment text is used for the same effect.
>
> In these two cases the injected JavaScript apparently can't be triggered in
> the administrative Dashboard, so these exploits require getting around
> comment moderation e.g. by posting one harmless comment first.
>
>
>
>
> *Proof of Concept*
> Enter the following as a comment:
>
> <a title='x onmouseover=alert(unescape(/hello%20world/.source))
> style=position:absolute;left:0;top:0;width:5000px;height:5000px
>  AAAAAAAAAAAA [64 kb] ...'></a>
>
>
> This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions 5.1.53
> and 5.5.41.
>
>
>
>
> *Solution*
> Disable comments (Dashboard, Settings/Discussion, select as restrictive
> options as possible). Do not approve any comments.
>
>
>
>
> *Credits*
> The vulnerability was discovered by Jouko Pynnönen of Klikki Oy.
>
> An up-to-date version of this document:
> http://klikki.fi/adv/wordpress2.html
>
>
>
> --
> Jouko Pynnönen <jouko@....fi>
> Klikki Oy - http://klikki.fi - @klikkioy
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives