oss-security - CVE request / Advisory: Slideshow (Wordpress plugin)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAD3Canf5OopQ-TNrP7GWfw1TbOVyOQzsqTn0EDsAFApKUCo7mA@mail.gmail.com>
Date: Sat, 2 May 2015 10:51:24 +1200
From: Matthew Daley <mattd@...fuzz.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE request / Advisory: Slideshow (Wordpress plugin) - Wordpress
 option value disclosure

I'd like to request a CVE ID for this issue. This is the first such
request; this message serves as an advisory as well.

Affected software: Slideshow (Wordpress plugin)
Affected versions: 2.2.8 - 2.2.21
Website: https://wordpress.org/plugins/slideshow-jquery-image-gallery/
Reported by: Matthew Daley

Description:

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function,
accessible by unauthenticated users as an AJAX action, can be abused
to force the disclosure of arbitrary Wordpress option values.

The function is intended to return the content of a user-specified
slideshow stylesheet, whether it be an administrator-created custom
one or a default one included with the plugin. Custom stylesheets are
stored as Wordpress option values, so the function first looks for an
option matching the user-specified stylesheet name. If a matching
option is found, its value is returned as the stylesheet content.

However, the function does not validate the user-specified stylesheet
name before this option lookup is performed (apart from sanitizing
certain characters using the filter_input function). Hence, it is
possible to specify any option name in place of an actual custom
stylesheet name, regardless of whether the option is for the Slideshow
plugin, another plugin, a theme, or Wordpress itself. Doing so will
cause the function to retrieve the value of the user-specified option
and output it to the user.

Fixed version: 2.2.22
Fix: https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
Changelog: https://wordpress.org/plugins/slideshow-jquery-image-gallery/changelog/

- Matthew Daley

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.