-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - Security Advisory - - - WordPress MU < 2.6 wpmu-blogs.php Crose Site Scrpting vulnerability - - ----------------------------------------------------------------------- Product: Wordpress-MU (multi-user) Version: Versions prior to 2.6 are affected Url: http://mu.wordpress.org Affected by: Coss Site Scripting Attack I. Introduction. Wordpress-MU, or multi-user, allows to run unlimited blogs with a single install of wordpress. It's widely used, some examples are WordPress.com or universities like Harvard II. Description and Impact Wordpress-MU is affected by a Cross Site Scripting vulnerability, an attacker can perform an XSS attack that allows him to access the targeted user cookies to gain administrator privileges In /wp-admin/wpmu-blogs.php an attacker can inject javascript code, the input variables "s" and "ip_address" of GET method aren't properly sanitized Here is a poc: PoC: http://site/path/wp-admin/wpmu-blogs.php?action=blogs&s=%27[XSS] PoC: http://site/path/wp-admin/wpmu-blogs.php?action=blogs&ip_address=%27[XSS] The impact is the attacker can gain administrator privileges on the application. III. Timeline May 14th, 2008 - Bug discovered May 14th, 2008 - Vendor contacted and the start of a syncronized code patching May 16th, 2008 - MU trunk code fixed July 28th, 2008 - WPMU 2.6 released September 2nd, 2008 - WPMU 2.6.1 released September 29th, 2008 - Security advisory released IV. Solution Upgrade to version 2.6 or upper of wordpress multi-user. It can be downloaded from http://mu.wordpress.org V. Credits Juan Galiana Lara <jgaliana gmail com> http://blogs.ua.es/jgaliana -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI4UoerJ7V/gP9Hy8RArw3AJkB1a1sgO5T9dvO9tbU0/QxE8DxFQCeJCiw yFDGBIx6Q5oyIKNEq4ZZ4Wc= =uQu6 -----END PGP SIGNATURE-----