They're registered as part of Automattic - https://hackerone.com/automattic
On Mon, Apr 27, 2015 at 10:41 PM, Scott Arciszewski <sc...@arciszewski.me> wrote: > The author added a note on his page: http://klikki.fi/adv/wordpress2.html > > Also, searching HackerOne does not reveal a public WordPress program, only > WP-API. Does this mean that WordPress was privately participating in > HackerOne for select hackers? If so, revealing that publicly is kind of > rude. :( > > On Mon, Apr 27, 2015 at 11:55 AM, Anthony Ferrara <ircmax...@gmail.com> > wrote: > > > Just for clarification, was the project given a chance to fix this or > > notified in any way prior to public announcement? > > > > On Sun, Apr 26, 2015 at 4:13 PM, Jouko Pynnonen <jo...@iki.fi> wrote: > > > *Overview* > > > Current versions of WordPress are vulnerable to a stored XSS. An > > > unauthenticated attacker can inject JavaScript in WordPress comments. > The > > > script is triggered when the comment is viewed. > > > > > > If triggered by a logged-in administrator, under default settings the > > > attacker can leverage the vulnerability to execute arbitrary code on > the > > > server via the plugin and theme editors. > > > > > > Alternatively the attacker could change the administrator’s password, > > > create new administrator accounts, or do whatever else the currently > > > logged-in administrator can do on the target system. > > > > > > > > > > > > > > > *Details* > > > If the comment text is long enough, it will be truncated when inserted > in > > > the database. The MySQL TEXT type size limit is 64 kilobytes so the > > comment > > > has to be quite long. > > > > > > The truncation results in malformed HTML generated on the page. The > > > attacker can supply any attributes in the allowed HTML tags, in the > same > > > way as the previous stored XSS vulnerabilities affecting WordPress. > > > > > > The vulnerability bears a similarity to the one reported by Cedric Van > > > Bockhaven in 2014 (patched this week, after 14 months). Instead of > using > > an > > > invalid UTF-8 character to truncate the comment, this time an > excessively > > > long comment text is used for the same effect. > > > > > > In these two cases the injected JavaScript apparently can't be > triggered > > in > > > the administrative Dashboard, so these exploits require getting around > > > comment moderation e.g. by posting one harmless comment first. > > > > > > > > > > > > > > > *Proof of Concept* > > > Enter the following as a comment: > > > > > > <a title='x onmouseover=alert(unescape(/hello%20world/.source)) > > > style=position:absolute;left:0;top:0;width:5000px;height:5000px > > > AAAAAAAAAAAA [64 kb] ...'></a> > > > > > > > > > This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions > 5.1.53 > > > and 5.5.41. > > > > > > > > > > > > > > > *Solution* > > > Disable comments (Dashboard, Settings/Discussion, select as restrictive > > > options as possible). Do not approve any comments. > > > > > > > > > > > > > > > *Credits* > > > The vulnerability was discovered by Jouko Pynnönen of Klikki Oy. > > > > > > An up-to-date version of this document: > > http://klikki.fi/adv/wordpress2.html > > > > > > > > > > > > -- > > > Jouko Pynnönen <jo...@iki.fi> > > > Klikki Oy - http://klikki.fi - @klikkioy > > > > > > _______________________________________________ > > > Sent through the Full Disclosure mailing list > > > https://nmap.org/mailman/listinfo/fulldisclosure > > > Web Archives & RSS: http://seclists.org/fulldisclosure/ > > > > _______________________________________________ > > Sent through the Full Disclosure mailing list > > https://nmap.org/mailman/listinfo/fulldisclosure > > Web Archives & RSS: http://seclists.org/fulldisclosure/ > > > > _______________________________________________ > Sent through the Full Disclosure mailing list > https://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
