The author added a note on his page: http://klikki.fi/adv/wordpress2.html
Also, searching HackerOne does not reveal a public WordPress program, only WP-API. Does this mean that WordPress was privately participating in HackerOne for select hackers? If so, revealing that publicly is kind of rude. :( On Mon, Apr 27, 2015 at 11:55 AM, Anthony Ferrara <ircmax...@gmail.com> wrote: > Just for clarification, was the project given a chance to fix this or > notified in any way prior to public announcement? > > On Sun, Apr 26, 2015 at 4:13 PM, Jouko Pynnonen <jo...@iki.fi> wrote: > > *Overview* > > Current versions of WordPress are vulnerable to a stored XSS. An > > unauthenticated attacker can inject JavaScript in WordPress comments. The > > script is triggered when the comment is viewed. > > > > If triggered by a logged-in administrator, under default settings the > > attacker can leverage the vulnerability to execute arbitrary code on the > > server via the plugin and theme editors. > > > > Alternatively the attacker could change the administrator’s password, > > create new administrator accounts, or do whatever else the currently > > logged-in administrator can do on the target system. > > > > > > > > > > *Details* > > If the comment text is long enough, it will be truncated when inserted in > > the database. The MySQL TEXT type size limit is 64 kilobytes so the > comment > > has to be quite long. > > > > The truncation results in malformed HTML generated on the page. The > > attacker can supply any attributes in the allowed HTML tags, in the same > > way as the previous stored XSS vulnerabilities affecting WordPress. > > > > The vulnerability bears a similarity to the one reported by Cedric Van > > Bockhaven in 2014 (patched this week, after 14 months). Instead of using > an > > invalid UTF-8 character to truncate the comment, this time an excessively > > long comment text is used for the same effect. > > > > In these two cases the injected JavaScript apparently can't be triggered > in > > the administrative Dashboard, so these exploits require getting around > > comment moderation e.g. by posting one harmless comment first. > > > > > > > > > > *Proof of Concept* > > Enter the following as a comment: > > > > <a title='x onmouseover=alert(unescape(/hello%20world/.source)) > > style=position:absolute;left:0;top:0;width:5000px;height:5000px > > AAAAAAAAAAAA [64 kb] ...'></a> > > > > > > This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions 5.1.53 > > and 5.5.41. > > > > > > > > > > *Solution* > > Disable comments (Dashboard, Settings/Discussion, select as restrictive > > options as possible). Do not approve any comments. > > > > > > > > > > *Credits* > > The vulnerability was discovered by Jouko Pynnönen of Klikki Oy. > > > > An up-to-date version of this document: > http://klikki.fi/adv/wordpress2.html > > > > > > > > -- > > Jouko Pynnönen <jo...@iki.fi> > > Klikki Oy - http://klikki.fi - @klikkioy > > > > _______________________________________________ > > Sent through the Full Disclosure mailing list > > https://nmap.org/mailman/listinfo/fulldisclosure > > Web Archives & RSS: http://seclists.org/fulldisclosure/ > > _______________________________________________ > Sent through the Full Disclosure mailing list > https://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
