WordPress XSS 0day

#1

Post by jchavannes » Mon, Apr 27, 2015, 7:01 PM UTC

Re: WordPress XSS 0day

#2

Post by lol768 » Mon, Apr 27, 2015, 7:14 PM UTC

The blogpost linked (http://klikki.fi/adv/wordpress2.html) in the article is rather worrying to read - especially the "Solution" section which suggests Klikki Oy had a lot of trouble communicating with WordPress and getting the bug fixed.

Interestingly, the WordPress blog states "A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a site. The vulnerability was discovered by Jouko Pynnönen."

I'm not very familiar with WordPress or its plugins, but does it make use of Content-Security-Policy headers? Those might've helped to minimise the risk (at least for users with modern browsers) to users browsing WordPress sites.

Re: WordPress XSS 0day

#3

Post by lightlyused » Mon, Apr 27, 2015, 8:34 PM UTC

lol768 wrote: post #2

The blogpost linked ( http://klikki.fi/adv/wordpress2.html ) in the article is rather worrying to read - especially the "Solution" section which suggests Klikki Oy had a lot of trouble communicating with WordPress and getting the bug fixed. Interestingly, the WordPress blog states "A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a…

It uses a mysqlism to trick its way fast a poorly written xss filter.

Re: WordPress XSS 0day

#4

Post by breakingcups » Tue, Apr 28, 2015, 11:04 AM UTC

Let's wait on the obligatory Cloudflare blogpost talking about how their paying customers are protected.