Message-ID: <CAHw3cgTEq7Tu9kM6gFzE8GwHdEy6K9puMUUWbGEBO2NL5foc9g@mail.gmail.com>
Date: Mon, 27 Apr 2015 22:51:01 +0200
From: Ryan Dewhurst <ryandewhurst@...il.com>
To: Scott Arciszewski <scott@...iszewski.me>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] WordPress 4.2 stored XSS

They're registered as part of Automattic - https://hackerone.com/automattic

On Mon, Apr 27, 2015 at 10:41 PM, Scott Arciszewski <scott@...iszewski.me>
wrote:

> The author added a note on his page: http://klikki.fi/adv/wordpress2.html
>
> Also, searching HackerOne does not reveal a public WordPress program, only
> WP-API. Does this mean that WordPress was privately participating in
> HackerOne for select hackers? If so, revealing that publicly is kind of
> rude. :(
>
> On Mon, Apr 27, 2015 at 11:55 AM, Anthony Ferrara <ircmaxell@...il.com>
> wrote:
>
> > Just for clarification, was the project given a chance to fix this or
> > notified in any way prior to public announcement?
> >
> > On Sun, Apr 26, 2015 at 4:13 PM, Jouko Pynnonen <jouko@....fi> wrote:
> > > *Overview*
> > > Current versions of WordPress are vulnerable to a stored XSS. An
> > > unauthenticated attacker can inject JavaScript in WordPress comments.
> The
> > > script is triggered when the comment is viewed.
> > >
> > > If triggered by a logged-in administrator, under default settings the
> > > attacker can leverage the vulnerability to execute arbitrary code on
> the
> > > server via the plugin and theme editors.
> > >
> > > Alternatively the attacker could change the administrator’s password,
> > > create new administrator accounts, or do whatever else the currently
> > > logged-in administrator can do on the target system.
> > >
> > >
> > >
> > >
> > > *Details*
> > > If the comment text is long enough, it will be truncated when inserted
> in
> > > the database. The MySQL TEXT type size limit is 64 kilobytes so the
> > comment
> > > has to be quite long.
> > >
> > > The truncation results in malformed HTML generated on the page. The
> > > attacker can supply any attributes in the allowed HTML tags, in the
> same
> > > way as the previous stored XSS vulnerabilities affecting WordPress.
> > >
> > > The vulnerability bears a similarity to the one reported by Cedric Van
> > > Bockhaven in 2014 (patched this week, after 14 months). Instead of
> using
> > an
> > > invalid UTF-8 character to truncate the comment, this time an
> excessively
> > > long comment text is used for the same effect.
> > >
> > > In these two cases the injected JavaScript apparently can't be
> triggered
> > in
> > > the administrative Dashboard, so these exploits require getting around
> > > comment moderation e.g. by posting one harmless comment first.
> > >
> > >
> > >
> > >
> > > *Proof of Concept*
> > > Enter the following as a comment:
> > >
> > > <a title='x onmouseover=alert(unescape(/hello%20world/.source))
> > > style=position:absolute;left:0;top:0;width:5000px;height:5000px
> > >  AAAAAAAAAAAA [64 kb] ...'></a>
> > >
> > >
> > > This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions
> 5.1.53
> > > and 5.5.41.
> > >
> > >
> > >
> > >
> > > *Solution*
> > > Disable comments (Dashboard, Settings/Discussion, select as restrictive
> > > options as possible). Do not approve any comments.
> > >
> > >
> > >
> > >
> > > *Credits*
> > > The vulnerability was discovered by Jouko Pynnönen of Klikki Oy.
> > >
> > > An up-to-date version of this document:
> > http://klikki.fi/adv/wordpress2.html
> > >
> > >
> > >
> > > --
> > > Jouko Pynnönen <jouko@....fi>
> > > Klikki Oy - http://klikki.fi - @klikkioy
> > >
> > > _______________________________________________
> > > Sent through the Full Disclosure mailing list
> > > https://nmap.org/mailman/listinfo/fulldisclosure
> > > Web Archives & RSS: http://seclists.org/fulldisclosure/
> >
> > _______________________________________________
> > Sent through the Full Disclosure mailing list
> > https://nmap.org/mailman/listinfo/fulldisclosure
> > Web Archives & RSS: http://seclists.org/fulldisclosure/
> >
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists