secuvera-SA-2014-01: Reflected XSS in W3 Total Cache
Affected Products
W3 Total Cache 0.9.4 (older releases have not been tested)
"The only WordPress Performance Optimization (WPO) framework;
designed to improve user experience and page speed. (..)
W3 Total Cache improves the user experience of your site by
increasing server performance, reducing the download times
and providing transparent content delivery network (CDN)
integration."
References
https://wordpress.org/plugins/w3-total-cache/
https://www.secuvera.de/advisories/secuvera-SA-2014-01.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8724
Summary:
If the option "Page cache debug info" is enabled, W3 Total
Cache adds some HTML-Comments including the "Cache key" which
is the URL itself. The URL is just reflected without any output
encoding.
Effect:
An attacker could include clientside Scriptcode in a request,
which will be reflected by the application. Using some social
engineering an attacker would be able to compromise users of
the application.
Vulnerable Scripts:
Debug Function
Examples:
https://$victim/nothing--<script>alert("XSS")</script>
Solution:
Install bug fix release. Always make sure to disable debug function
in productive environments.
Disclosure Timeline:
2014/09/17 vendor contacted via https://www.w3-edge.com/contact/
2014/10/07 vendor reacted including a first patch preview
2014/10/14 notified vendor the patch does not address the issue
2014/10/24 vendor sent a second patch preview
2014/12/10 vendor published 0.9.4.1 release
2014/12/16 public disclosure
Credits:
Tobias Glemser, secuvera GmbH
tglemser@secuvera.de
https://www.secuvera.de
Disclaimer:
All information is provided without warranty. The intent is to
provide information to secure infrastructure and/or systems, not
to be able to attack or damage. Therefore secuvera shall
not be liable for any direct or indirect damages that might be
caused by using this information.
