Message-ID: <CAPKwhwuqxpAoBfGi4r7jbYP+_OLu_68WHNehc-nus_TzCGyZ0w@mail.gmail.com>
Date: Mon, 27 Apr 2015 16:41:31 -0400
From: Scott Arciszewski <scott@...iszewski.me>
To: Anthony Ferrara <ircmaxell@...il.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] WordPress 4.2 stored XSS

The author added a note on his page: http://klikki.fi/adv/wordpress2.html

Also, searching HackerOne does not reveal a public WordPress program, only
WP-API. Does this mean that WordPress was privately participating in
HackerOne for select hackers? If so, revealing that publicly is kind of
rude. :(

On Mon, Apr 27, 2015 at 11:55 AM, Anthony Ferrara <ircmaxell@...il.com>
wrote:

> Just for clarification, was the project given a chance to fix this or
> notified in any way prior to public announcement?
>
> On Sun, Apr 26, 2015 at 4:13 PM, Jouko Pynnonen <jouko@....fi> wrote:
> > *Overview*
> > Current versions of WordPress are vulnerable to a stored XSS. An
> > unauthenticated attacker can inject JavaScript in WordPress comments. The
> > script is triggered when the comment is viewed.
> >
> > If triggered by a logged-in administrator, under default settings the
> > attacker can leverage the vulnerability to execute arbitrary code on the
> > server via the plugin and theme editors.
> >
> > Alternatively the attacker could change the administrator’s password,
> > create new administrator accounts, or do whatever else the currently
> > logged-in administrator can do on the target system.
> >
> >
> >
> >
> > *Details*
> > If the comment text is long enough, it will be truncated when inserted in
> > the database. The MySQL TEXT type size limit is 64 kilobytes so the
> comment
> > has to be quite long.
> >
> > The truncation results in malformed HTML generated on the page. The
> > attacker can supply any attributes in the allowed HTML tags, in the same
> > way as the previous stored XSS vulnerabilities affecting WordPress.
> >
> > The vulnerability bears a similarity to the one reported by Cedric Van
> > Bockhaven in 2014 (patched this week, after 14 months). Instead of using
> an
> > invalid UTF-8 character to truncate the comment, this time an excessively
> > long comment text is used for the same effect.
> >
> > In these two cases the injected JavaScript apparently can't be triggered
> in
> > the administrative Dashboard, so these exploits require getting around
> > comment moderation e.g. by posting one harmless comment first.
> >
> >
> >
> >
> > *Proof of Concept*
> > Enter the following as a comment:
> >
> > <a title='x onmouseover=alert(unescape(/hello%20world/.source))
> > style=position:absolute;left:0;top:0;width:5000px;height:5000px
> >  AAAAAAAAAAAA [64 kb] ...'></a>
> >
> >
> > This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions 5.1.53
> > and 5.5.41.
> >
> >
> >
> >
> > *Solution*
> > Disable comments (Dashboard, Settings/Discussion, select as restrictive
> > options as possible). Do not approve any comments.
> >
> >
> >
> >
> > *Credits*
> > The vulnerability was discovered by Jouko Pynnönen of Klikki Oy.
> >
> > An up-to-date version of this document:
> http://klikki.fi/adv/wordpress2.html
> >
> >
> >
> > --
> > Jouko Pynnönen <jouko@....fi>
> > Klikki Oy - http://klikki.fi - @klikkioy
> >
> > _______________________________________________
> > Sent through the Full Disclosure mailing list
> > https://nmap.org/mailman/listinfo/fulldisclosure
> > Web Archives & RSS: http://seclists.org/fulldisclosure/
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists