{"id":3908,"date":"2015-04-30T14:20:38","date_gmt":"2015-04-30T06:20:38","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3908"},"modified":"2015-09-09T19:36:38","modified_gmt":"2015-09-09T11:36:38","slug":"wordpress-critical-zero-day-vulnerability-fixed-in-a-hurry","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/04\/wordpress-critical-zero-day-vulnerability-fixed-in-a-hurry\/","title":{"rendered":"WordPress Critical Zero-Day Vulnerability Fixed In A Hurry"},"content":{"rendered":"

So this is an interesting announcement due to the discussion points it brings up about responsible disclosure, it seems like in this case a researcher published his findings about a WordPress<\/a> critical zero-day vulnerability without informing WordPress before hand.<\/p>\n

\"WordPress<\/p>\n

And they got it fixed REAL quickly, where as in a previous (pretty similar) case – they took 14 months to fix it, leaving their users at risk for that period.<\/p>\n

WordPress 4.2.1 was released on Monday to address a critical zero-day vulnerability disclosed on Sunday by Finnish researcher Jouko Pynn\u00f6nen of Klikki Oy. The expert published the details of the security bug without notifying WordPress because he was displeased with the way developers handled his recent vulnerability reports.<\/p>\n

The stored cross-site scripting (XSS) vulnerability disclosed by Pynnonen is similar to a flaw discovered by Belgian researcher Cedric Van Bockhaven, which WordPress fixed last week with the release of version 4.1.2, more than a year after it was reported. The bug, which affects WordPress 4.2 and earlier, can be exploited by an unauthenticated attacker to execute arbitrary code via very long comments that get truncated when they\u2019re saved into the database.<\/p>\n

\u201cThe attacker is sending fragments of HTML code to the server that contains JavaScript in it. WordPress tries to verify the content, but misses the embedded script. This specific exploit is because the attacker sends very long content \u2013 over 64Kb, which is truncated in the database,\u201d Jeff Williams, CTO of Contrast Security, explained via email. \u201c[When] WordPress sends that data back to the browser as part of a webpage, the script executes.\u201d<\/p>\n

\u201cThat would be enough for an interesting attack, but this particular exploit goes further. When the attack is executed on an administrator, it uses the administrative privilege to install plugins and execute content directly on the server. Most XSS problems are not exploitable in a way that allows a complete remote host takeover,\u201d Williams added.<\/p><\/blockquote>\n