Using MySQL column truncation to trick an XSS past their filter... clever. I never would have thought to do that. :)
On Sun, Apr 26, 2015 at 4:13 PM, Jouko Pynnonen <jo...@iki.fi> wrote: > *Overview* > Current versions of WordPress are vulnerable to a stored XSS. An > unauthenticated attacker can inject JavaScript in WordPress comments. The > script is triggered when the comment is viewed. > > If triggered by a logged-in administrator, under default settings the > attacker can leverage the vulnerability to execute arbitrary code on the > server via the plugin and theme editors. > > Alternatively the attacker could change the administrator’s password, > create new administrator accounts, or do whatever else the currently > logged-in administrator can do on the target system. > > > > > *Details* > If the comment text is long enough, it will be truncated when inserted in > the database. The MySQL TEXT type size limit is 64 kilobytes so the comment > has to be quite long. > > The truncation results in malformed HTML generated on the page. The > attacker can supply any attributes in the allowed HTML tags, in the same > way as the previous stored XSS vulnerabilities affecting WordPress. > > The vulnerability bears a similarity to the one reported by Cedric Van > Bockhaven in 2014 (patched this week, after 14 months). Instead of using an > invalid UTF-8 character to truncate the comment, this time an excessively > long comment text is used for the same effect. > > In these two cases the injected JavaScript apparently can't be triggered in > the administrative Dashboard, so these exploits require getting around > comment moderation e.g. by posting one harmless comment first. > > > > > *Proof of Concept* > Enter the following as a comment: > > <a title='x onmouseover=alert(unescape(/hello%20world/.source)) > style=position:absolute;left:0;top:0;width:5000px;height:5000px > AAAAAAAAAAAA [64 kb] ...'></a> > > > This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions 5.1.53 > and 5.5.41. > > > > > *Solution* > Disable comments (Dashboard, Settings/Discussion, select as restrictive > options as possible). Do not approve any comments. > > > > > *Credits* > The vulnerability was discovered by Jouko Pynnönen of Klikki Oy. > > An up-to-date version of this document: > http://klikki.fi/adv/wordpress2.html > > > > -- > Jouko Pynnönen <jo...@iki.fi> > Klikki Oy - http://klikki.fi - @klikkioy > > _______________________________________________ > Sent through the Full Disclosure mailing list > https://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/