[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <55F67C1B.2020503@gmail.com>
Date: Mon, 14 Sep 2015 10:49:47 +0300
From: Anti Räis <antirais@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-Request for stored WCI (a.k.a XSS) in Visual Form Builder 2.7.5 -
2.8.4
Greetings,
I've discovered a vulnerability in the following component and would
like to request CVE-ID for it:
Product: Visual Form Builder
(https://wordpress.org/plugins/visual-form-builder/)
Version: 2.7.5 - 2.8.4 (according to the source code), fixed in 2.8.5
Product-type: Wordpress plugin
Vendor: http://vfbpro.com/
Fixed: 2015-09-09, reported 2015-09-06
Changelog:
https://plugins.trac.wordpress.org/changeset?old_path=%2Fvisual-form-builder%2Ftags%2F2.8.4&old=1244830&new_path=%2Fvisual-form-builder%2Ftags%2F2.8.5&new=1244830&sfp_email=&sfph_mail=
Description:
This plugin is used to create feedback forms. Unauthenticated user can submit
malicious code and it is shown to the authenticated administrator in the entries
page. Upon viewing the submitted entry, the attackers code executes resulting in
web content injection attack (WCI, a.k.a XSS).
Vulnerability:
--- start visual-form-builder/includes/class-entries-detail.php ---
160 case 'textarea' :
161 case 'html' :
162 ?>
163 <tr valign="top">
164 <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th>
165 <td style="background:#eee;border:1px solid #ddd"><?php echo wpautop( stripslashes( wp_specialchars_decode( esc_html( $obj->value ) ) ) ); ?></td>
166 </tr>
167 <?php
168 break;
169 default :
171 ?>
172 <tr valign="top">
173 <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th>
174 <td style="background:#eee;border:1px solid #ddd"><?php echo stripslashes( wp_specialchars_decode( esc_html( $obj->value ) ) ); ?></td>
175 </tr>
176 <?php
177 break;
--- end visual-form-builder/includes/class-entries-detail.php ---
The vulnerability lies in the following PHP code:
<?php echo stripslashes( wp_specialchars_decode( esc_html( $obj->value ) ) ); ?>
The $obj->value contains user supplied data and is escaped using the esc_html()
and then HTML special characters are decoded using wp_specialchars_decode()
which essentially neuters the esc_html(). Finally, the stripslashes() is
applied, which removes '\' from the given argument.
Poc:
* Submit the following value in the form's text field:
\<svg/onload=alert(1) ;
* authenticated administrator views the entry and executes the code
Visual Form Builder -> Entries -> (attacker's entry) -> View
Disclosure timeline:
2015-09-06 - discovery, contacted the developers
2015-09-08 - sent further details and requested feedback
2015-09-09 - new release with the fix was released
All the best,
Anti Räis
Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
