XSS Vulnerability

  • Resolved amarie

    (@tuesdave)


    10 years, 7 months ago

    Hello. I had a professional security audit of my website done and they found a slight vulnerability in your plugin.

    Location: quick-pagepost-redirect-plugin\quick_pagepost_redirect_plugin.php line 246.

    $linkcontent[] = '<li class="faq-item"><a name="faq-'.$aqr.'"></a><h3 class="qa"><span class="qa">Q. </span>'.esc_html( $item->get_title() ).'</h3><div class="qa-content"><span class="qa answer">A. </span>'.$item->get_content().'</div><div class="toplink"><a href="#faq-top">top ↑</a></li>';

    In the ppr_faq_page() function the title is escaped when building the faq html, but not the content. Sanitizing $item->get_content() should be done as well. The HTML is being read from a vendor’s website, and so it is best to sanitize any outside input.

    Are there any plans to patch this in the near future? If not I would have to maintain this on my own.

    Thank you!

    https://ww.wp.xz.cn/plugins/quick-pagepost-redirect-plugin/

Viewing 4 replies - 1 through 4 (of 4 total)
  • Don Fischer

    (@prophecy2040)

    10 years, 7 months ago

    tuesdave,
    First – thanks for bringing this to our attention, although it is not a crucial item because the content is coming from a verified feed and we control the feed (which is verified when it comes into your site).

    That said, I want to point out something – NEVER post a security vulnerability to a public forum before contacting the creator and giving them a chance to fix it and release a patch – otherwise you are letting the rest of the world (hackers included) know the problem that has no current solution. Then after the fix is available, you can post about it to let others know they need to update because of a security issue. This is called “Responsible Disclosure”.

    In this case it is not that big of a deal because a hacker would need to gain access to your admin area first and then pass bad data to the feed, so it is very unlikely to happen unless your site is already compromised.

    We will be updating the plugin in the next few days (probably by Monday) and I will make sure this fix is in the update.

    Again, thanks for letting us know.
    Warmest regards,
    Don

    Thread Starter amarie

    (@tuesdave)

    10 years, 7 months ago

    Thank you. Sorry for this, you’re absolutely right.

    Don Fischer

    (@prophecy2040)

    10 years, 7 months ago

    Not a problem, just a learn-able moment!

    An update on the issue:
    I have reached out to the Simplepie/WordPress community find out if this is really an issue or not. Upon further investigation on our part, this part of the code is related to the SimplePie function get_content() and not the WordPress get_the_content() function (which should be escaped when not using the_content()). So looking through their documentation, they show direct output like above – probably because that function uses a sanitize function on the data before returning it.

    I am waiting for clarification on this so I will post the outcome here. If we do not hear back from anyone in time for the update, we will just assume that is should be escaped and will add that to the plugin update.

    Warm regards,
    Don

    Don Fischer

    (@prophecy2040)

    10 years, 7 months ago

    Here is what I was able to find out, thanks to some helpful folk:

    In the SimplePie documentation it states:

    SimplePie protects against malicious feeds by sanitizing the data.

    In addition, it strips the following:
    public $strip_htmltags = array('base', 'blink', 'body', 'doctype', 'embed', 'font', 'form', 'frame', 'frameset', 'html', 'iframe', 'input', 'marquee', 'meta', 'noscript', 'object', 'param', 'script', 'style');

    So if there is no script tags allowed, there is no XSS.

    Please let the security audit team know that this is not a correct assessment of the plugin. Additionally, we did not need to escape the title either – we just did it so there was no HTML in the title, but it was not necessary for any other reason.

    If you need us to contact them please email me the contact information at [email protected].

    Warmest regards,
    Don

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘XSS Vulnerability’ is closed to new replies.

Tags