Bug: WordPress Pretty Photo Cross Site Scripting ( Ascii Version )

Search:
WLB2

WordPress Pretty Photo Cross Site Scripting

Published / (Updated)
Credit
Risk
2013-11-21 / 2013-12-21
Rafay Baloch
Low
CWE
CVE
Local
Remote
CWE-79
CVE-2013-6837
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

Wp-Pretty Photo DOM Based XSS Vulnerability

Details
=======
Product: PrettyPhoto Plugin
Security-Risk: Moderate
Remote-Exploit: yes
Company: RHAINFOSEC
Website: http://services.rafayhackingarticles.net
Vendor-URL: https://github.com/scaron/prettyphoto
Vendor-Status: informed
Advisory-Status: published

Credits
=======
Discovered by: Rafay Baloch
http://services.rafayhackingarticles.net

Description
========
The worpdress pretty photo plugin appears to be vulnerable to a DOM based
xss, unlike other XSS, dom based xss occurs on the client side, thus
leaving all the server side defenses worthlesss. The issue occurs inside
the client side javascripts
where the source (User supplied input) is passed through a vulnerable sink
(Anything that creates/writes) without sanitsing/escaping the user supplied
input

More Details
=========


Line 623: hashIndex = getHashtag();

Inside the line 623, we see a variable hashIndex which calls th e
getHashtag() function, which is responsible for returning the user
supplied values after the hash.


Let's take a look at teh getHashtag() function:

getHashtag()
{
url=location.href;hashtag=(url.indexOf('#!')!=-1)?decodeURI
(url.substring(url.indexOf('#!')+2,url.length)):false;return
hashtag;};

The function getHashtag() is used for returning the user supplied input,
the function also checks if the user input contains the hash bang and then
returns the value.

setTimeout(function()
{
$("a[rel^='" + hashRel + "']:eq(" + hashIndex + ")").trigger('click'); },
50);

Finally we have the above line which is responsible for the cause of the
dom based xss, the $("a[rel^='" + hashRel + "']:eq(" + hashIndex + ")
writes the user supplied input to the dom without sanitising the input.

POC
===

http://target.com/#!%22%3E%3Cimg%20src=1%20onerror=prompt%280%29;%3E//

The issue was fixed by sanitising the "hashrel" input before returning it
to the user.

hashIndex = parseInt(hashIndex);
hashRel = hashRel.replace(/([ #;&,.+*~\':"!^$[\]()=>|\/])/g,'\\$1');


References
==========

http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.html


References:

http://services.rafayhackingarticles.net
http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.html

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version