#1

Stored XSS in WordPress Core - Magebay.com

in Market Section Tue Mar 14, 2017 8:26 am
by magebaytn • 6 Posts

As you may remember, we just lately blogged in regards to a critical Content Injection Vulnerability in WordPress which allowed attackers to deface vulnerable websites. While our original disclosure only detailed one vulnerability, we actually reported two to the WordPress team. As it turns out, it was possible to leverage the content injection issue to achieve a stored cross-site scripting strike. This problem was patched in WordPress 4.7.3.
WILL YOU BE at Risk?
This vulnerability has been present in WordPress for a long time, well before 4.7.
Combined with recent content shot vulnerability we found, it's possible for a remote attacker to deface a random post on the site and store malicious Javascript code in it. This code would be carried out when a site visitors view the post and when anyone edits the post from the WordPress dashboard. Because of this, an administrator attempts to fix the defaced post, the would unknowingly cause the destructive script, that could then be used to put a backdoor on the website and create new admin users.
The content treatment vulnerability was patched in version 4.7.2, and as such, the chance posed by this XSS vulnerability is much less severe. Furthermore, only users with certain privileges, like contributors, can presently exploit the problem.
Technical Details
Being able to edit any solitary post on a site is a serious vulnerability alone, but there's a notable disadvantage for attackers. Because of the limitations of the WordPress function wp_kses(), a harmful actor was very limited in terms of the HTML tags that may be inserted in the post.
This would result in a post only containing the text “alert(1)”.
We felt it was our duty as security professionals to dig deeper and see how far an attacker could go with this vulnerability. In the process, we discovered the embedshortcode could produce a more dangerous scenario.
In a nutshell, the embed shortcode takes an src (source link) attribute and tries several regular expressions in order to find out which handler method the script should use so the source link can be embedded properly. The one that caught our attention was youtube_embed_url which was registered with the following regex:

The only important detail here is that the last capturing group will catch anything that isn’t a “slash” character; this could include minus-than and greater-than characters too. We checked what the wp_embed_handler_youtube callback function did with this chunk of text. What we found is that it basically generates a Youtube URL and concatenates the last capturing group – youtube(.)com/watch?v=$LASTCAPTUREGROUP.
After doing this, it pushes the generated link to wp_embed and itsautoembed()method.
View more : https://productsdesignerpro.com

That’s where things gets really interesting. If $content (the embed URL) contains something like this:
none of these regular expressions will match, so autoembed() simply returns the$content URL.
In an attack scenario, the story would end here, but things got a tad more complex when we remembered that everything we send to our post would be sanitized by the HTML sanitization function wp_kses().
Even if we tried sending a shortcode like the following:

It would be shrunk down to:

However, we also looked at the shortcode_parse_atts function, which is responsible for parsing shortcode parameters.

In short, it uses a regular expression that matches all pairs of keys and values in a shortcode, and then it creates an associative array out of it while ensuring each of the attributes values is passed through the stripcslashes function. This allows us to send escape sequences like \x41 (A), or \x3c (<)
All that was left in order to get our XSS working was combining all the previous advances into one simple shortcode:

With this, we would get a working stored XSS exploit.
In Conclusion
If you have disabled automatic updates on your website, update to WordPress 4.7.3 as soon as possible!
In the event where you cannot do this, we strongly recommend leveraging the https://www.magebay.com or equivalent technology to have the vulnerability patched virtually.

Scroll up

#2

RE: Stored XSS in WordPress Core - Magebay.com

in Market Section Sat May 06, 2017 12:54 pm
by seven clock • 580 Posts

http://www.adidasnmdsales.us
http://www.nike-airmax90.com
http://www.running-shoes.top
http://www.starboots.us
http://www.michael-kors-bags.us
http://www.asics.us.com
http://www.yeezy-outlet.us
http://www.coach-online.us
http://www.timberland-outlets.org
http://www.jordan-air.us
http://www.sunglasses--oakley.us
http://www.adidasyeezy.org

Adidas NMD
Nike Air Max
Running Shoes
StarBoots
Michael Kors
Yeezy
Asics
Coach
Timberland
Oakley
Jordan


Adidas NMD
Nike Air Max
Running Shoes
StarBoots
Michael Kors
Yeezy
Asics
Coach
Timberland
Oakley
Jordan

<a href="http://www.adidasnmdsales.us/"><b>Adidas NMD</b></a><br /><br />
<a href="http://www.nike-airmax90.com/"><b>Nike Air Max</b></a><br /><br />
<a href="http://www.running-shoes.top/"><b>Running Shoes</b></a><br /><br />
<a href="http://www.starboots.us/"><b>StarBoots</b></a><br /><br />
<a href="http://www.michael-kors-bags.us/"><b>Michael Kors</b></a><br /><br />
<a href="http://www.yeezy-outlet.us/"><b>Yeezy</b></a><br /><br />
<a href="http://www.asics.us.com/"><b>Asics</b></a><br /><br />
<a href="http://www.coach-online.us/"><b>Coach</b></a><br /><br />
<a href="http://www.timberland-outlets.org/"><b>Timberland </b></a><br /><br />
<a href="http://www.sunglasses--oakley.us/"><b> Oakley </b></a><br /><br />
<a href="http://www.jordan-air.us/"><b> Jordan </b></a>

Scroll up

#3

RE: Stored XSS in WordPress Core - Magebay.com

in Market Section Fri Sep 01, 2017 7:04 am
by audiogats • 48 Posts

car paint spray
car spray paints
aerosol spray paint for cars
paint remover
paint remover for metal
spray paint
spray paint cans
plasti dip spray
rubber spray paint for cars
tyre polish
tyre cleaner
bike paint
bike spray paints
spray paint for metal
Foamy cleaner
Brake and Parts cleaner
spray paint
aerosol spray paint
metallic spray paint
spray paint for metal
spray paint for plastic
primer spray paint
metal spray paint
cheap spray paint
automotive spray paint
acrylic spray paint
normal spray paint
rubber paint
rubber spray
rubber spray paint
rubber paint for cars
rubber coating spray
rubber coating paint
rubber coating for metal
spray paint for cars
rubber paint spray
spray rubber coating
rubber spray coating
best removable spray paints
paint remover india
paint remover spray
aerosol spray paint
spray paint for cars
automotive spray paint
tyre polish
tyre cleaner
bike spray paints
paint remover
Spray cleaners
Best Spray cleaners
Spray cleaners in Delhi
Commercial Photography
Automated Product Photography
WinBiz 360 degree turntable
Best Automated Product Photography
Automated Product Photography in india
Automated Product Photography in delhi
automatic photography
WinBiz 3D
Winbiz
360 photography
automatic photography
ecommerce product photography
3d photography
commercial photography
product photoshoot
corporate photography
winbiz lightbox
winbiz 3d auto-imaging system
3d photography
commercial photography
360 photography
winbiz in india
winbiz in delhi
winbiz
win biz
professional photography studio
commercial photography
product photoshoot
catalogs emendation
corporate photography
product photography
3 axis gimbal
uo online
trio
uoplay
gimbal dslr
dslr gimbal
3 axis gimbal dslr
3 axis gimbal stabilizer
gopro gimbal
gimbal for gopro
handheld gimbal
gimbal dslr
gimbal gopro
gimbal camera
trio
the trio
trio website
3d trio camera
buy best trio gimbal
best trio gimbal buy
trio gimbal at best price
trio gimbal price
trio gimbal price in india
Gimbal In India
Gimbal for iphones
uo online
uoplayer
smartphone gimbal stabilizer
uoplay gimbal
handheld camera stabilizer
uoplay
3 axis gimbal for smartphone
iphone gopro gimbal
3 axis gimbal stabilizer
handheld gimbal stabilize
steady gimbal
VPS Hosting
voip service providers
voip billing system
voip billing software
wholesale routes
voip billing solutions
itel mobile dialer
auto dialer
predictive dialer
call dialer
voip dialer
phone dialler
dialer system
auto dialer system
voip auto dialer
quick dialer
dialer voip
soft switches
softswitch
sip softswitch
softswitches
soft switches
best soft switches
soft switches services
soft switches service
best soft switches services
voip service providers
voip billing system
voip billing software
voip south africa
voip phone solutions
voip providers in south africa
voip secutiry solutions
voip phones south africa
voip for business
voip solutions for business
Wholesale Voip Provider
Voip Termination
VOIP Trunk
Sip trunk
Sip gateway
voip business
wholesale routes
voip routes provider
voip wholesale
wholesale service provider
voip wholesale
wholesale az voip termination
wholesale voip termination provider
wholesale termination
voip wholesale rates
voip wholesale carrier
business voip provider
voip business
wholesale routes
voip routes provider
call termination business
voip termination business
wholesale voip business
wholesale routes
Sip trunk
Sip gateway
wholesale voip provider
voip termination business
voip termination process
sip trunking
voip trunk
voip termination provider
voip for call center
voip termination provider
voip termination
wholesale voip termination provider
wholesale voip termination services
wholesale az voip termination
voip call termination
call termination
Wholesale Service for Call Center VOIP
Wholesale Voip Provider
wholesale Voip Termination
wholesale voip services
voip wholesale services
voip wholesale rates
VPS Hosting
Managed vps hosting
Windows vps
Dedicated server hosting
Virtual server hosting
Cloud web hosting
Localstorage
Webstorage
Storage server
Website hosting
Windows hosting
Cheap web hosting
Linux hosting
Linux vps hosting
VPS Hosting
Virtual Server Hostin
SD VPS Server
Windows VPS
Windows VPS Hosting
Cheap Linux VPS
SSD VPS Server
SSD Hosting
Managed VPS Hosting
Data storage
Cloud based storage
Secure cloud storage
Storage server
Server storage
Ssd server
Online cloud storage
Private cloud storage
Dedicated server hosting
Best dedicated server hosting
Managed dedicated server
Windows dedicated server
Dedicated hosting server
Linux Dedicated Server Hosting
Managed dedicated hosting
Dedicated server hosting plans
Linux hosting
Linux web hosting
Linux vps hosting
Linux server hosting
Linux virtual server hosting
Linux hosts
Web hosting
Website hosting
Best web hosting
Web hosting services
Cheap web hosting
Best hosting
Windows hosting
Web hosting usa
Malware detection
Web malware detection
Malware detection online
Online web malware detection
Malware scanner for website
Online website malware scanner
SSL Certificate Online
SSL Certificates
sitelock
sitelock cdn
sitelock malware scanner
sitelock domain security
sitelock firewall
sitelock infinity
sitelock malware scanner review
Data migration services
Data migration
Email migration services
Website migration services
Email migration
Website Protection
Hostguard
Website data protection
Best website protection
Website protection service
Buy Hostguard

Scroll up

#4

RE: Stored XSS in WordPress Core - Magebay.com

in Market Section Fri Sep 01, 2017 7:17 am
by audiogats • 48 Posts

car paint spray
car spray paints
aerosol spray paint for cars
paint remover
paint remover for metal
spray paint
spray paint cans
plasti dip spray
rubber spray paint for cars
tyre polish
tyre cleaner
bike paint
bike spray paints
spray paint for metal
Foamy cleaner
Brake and Parts cleaner
spray paint
aerosol spray paint
metallic spray paint
spray paint for metal
spray paint for plastic
primer spray paint
metal spray paint
cheap spray paint
automotive spray paint
acrylic spray paint
normal spray paint
rubber paint
rubber spray
rubber spray paint
rubber paint for cars
rubber coating spray
rubber coating paint
rubber coating for metal
spray paint for cars
rubber paint spray
spray rubber coating
rubber spray coating
best removable spray paints
paint remover india
paint remover spray
aerosol spray paint
spray paint for cars
automotive spray paint
tyre polish
tyre cleaner
bike spray paints
paint remover
Spray cleaners
Best Spray cleaners
Spray cleaners in Delhi
Commercial Photography
Automated Product Photography
WinBiz 360 degree turntable
Best Automated Product Photography
Automated Product Photography in india
Automated Product Photography in delhi
automatic photography
WinBiz 3D
Winbiz
360 photography
automatic photography
ecommerce product photography
3d photography
commercial photography
product photoshoot
corporate photography
winbiz lightbox
winbiz 3d auto-imaging system
3d photography
commercial photography
360 photography
winbiz in india
winbiz in delhi
winbiz
win biz
professional photography studio
commercial photography
product photoshoot
catalogs emendation
corporate photography
product photography
3 axis gimbal
uo online
trio
uoplay
gimbal dslr
dslr gimbal
3 axis gimbal dslr
3 axis gimbal stabilizer
gopro gimbal
gimbal for gopro
handheld gimbal
gimbal dslr
gimbal gopro
gimbal camera
trio
the trio
trio website
3d trio camera
buy best trio gimbal
best trio gimbal buy
trio gimbal at best price
trio gimbal price
trio gimbal price in india
Gimbal In India
Gimbal for iphones
uo online
uoplayer
smartphone gimbal stabilizer
uoplay gimbal
handheld camera stabilizer
uoplay
3 axis gimbal for smartphone
iphone gopro gimbal
3 axis gimbal stabilizer
handheld gimbal stabilize
steady gimbal
VPS Hosting
voip service providers
voip billing system
voip billing software
wholesale routes
voip billing solutions
itel mobile dialer
auto dialer
predictive dialer
call dialer
voip dialer
phone dialler
dialer system
auto dialer system
voip auto dialer
quick dialer
dialer voip
soft switches
softswitch
sip softswitch
softswitches
soft switches
best soft switches
soft switches services
soft switches service
best soft switches services
voip service providers
voip billing system
voip billing software
voip south africa
voip phone solutions
voip providers in south africa
voip secutiry solutions
voip phones south africa
voip for business
voip solutions for business
Wholesale Voip Provider
Voip Termination
VOIP Trunk
Sip trunk
Sip gateway
voip business
wholesale routes
voip routes provider
voip wholesale
wholesale service provider
voip wholesale
wholesale az voip termination
wholesale voip termination provider
wholesale termination
voip wholesale rates
voip wholesale carrier
business voip provider
voip business
wholesale routes
voip routes provider
call termination business
voip termination business
wholesale voip business
wholesale routes
Sip trunk
Sip gateway
wholesale voip provider
voip termination business
voip termination process
sip trunking
voip trunk
voip termination provider
voip for call center
voip termination provider
voip termination
wholesale voip termination provider
wholesale voip termination services
wholesale az voip termination
voip call termination
call termination
Wholesale Service for Call Center VOIP
Wholesale Voip Provider
wholesale Voip Termination
wholesale voip services
voip wholesale services
voip wholesale rates
VPS Hosting
Managed vps hosting
Windows vps
Dedicated server hosting
Virtual server hosting
Cloud web hosting
Localstorage
Webstorage
Storage server
Website hosting
Windows hosting
Cheap web hosting
Linux hosting
Linux vps hosting
VPS Hosting
Virtual Server Hostin
SD VPS Server
Windows VPS
Windows VPS Hosting
Cheap Linux VPS
SSD VPS Server
SSD Hosting
Managed VPS Hosting
Data storage
Cloud based storage
Secure cloud storage
Storage server
Server storage
Ssd server
Online cloud storage
Private cloud storage
Dedicated server hosting
Best dedicated server hosting
Managed dedicated server
Windows dedicated server
Dedicated hosting server
Linux Dedicated Server Hosting
Managed dedicated hosting
Dedicated server hosting plans
Linux hosting
Linux web hosting
Linux vps hosting
Linux server hosting
Linux virtual server hosting
Linux hosts
Web hosting
Website hosting
Best web hosting
Web hosting services
Cheap web hosting
Best hosting
Windows hosting
Web hosting usa
Malware detection
Web malware detection
Malware detection online
Online web malware detection
Malware scanner for website
Online website malware scanner
SSL Certificate Online
SSL Certificates
sitelock
sitelock cdn
sitelock malware scanner
sitelock domain security
sitelock firewall
sitelock infinity
sitelock malware scanner review
Data migration services
Data migration
Email migration services
Website migration services
Email migration
Website Protection
Hostguard
Website data protection
Best website protection
Website protection service
Buy Hostguard

Scroll up

#5

RE: Stored XSS in WordPress Core - Magebay.com

in Market Section Fri Sep 15, 2017 11:15 am
by timkiem • 28 Posts

học kế toán tổng hợp thực hành
lớp học kế toán tổng hợp thực hành tại cầu giấy từ liêm
lớp học kế toán tổng hợp thực hành tại thanh xuân
==
lớp học kế toán tổng hợp thực hành tại long biên
lớp học kế toán tổng hợp thực hành tại hà đông
lớp học kế toán tổng hợp thực hành tại đống đa
lớp học kế toán tổng hợp thực hành tại gia lâm
==
lớp học kế toán tổng hợp thực hành tại bắc ninh
lớp học kế toán tổng hợp thực hành tại hải phòng
lớp học kế toán tổng hợp thực hành tại quận 3
==
lớp học kế toán tổng hợp thực hành tại quận thủ đức
lớp học kế toán tổng hợp thực hành tại quận tân phú
lớp học kế toán tổng hợp thực hành tại quận bình dương
==
lớp học kế toán tổng hợp thực hành tại biên hòa đồng nai
khóa học kế toán dành cho giám đốc
khóa học kế toán dành cho giám đốc tại thanh xuân
==
khóa học kế toán dành cho giám đốc tại hai bà trưng
khóa học kế toán dành cho giám đốc tại đống đa
khóa học kế toán dành cho giám đốc tại hà đông
==
khóa học kế toán dành cho giám đốc tại long biên
khóa học kế toán dành cho giám đốc tại gia lâm
==
khóa học thực hành kế toán xây dựng
khóa học thực hành kế toán xây dựng tại gia lâm
khóa học thực hành kế toán xây dựng tại đống đa
==
khóa học thực hành kế toán xây dựng tại hai bà trưng
khóa học thực hành kế toán xây dựng tại long biên
khóa học thực hành kế toán xây dựng tại hà đông
==
khóa học thực hành kế toán xây dựng tại cầu giấy từ liêm
khóa học thực hành kế toán xây dựng tại thanh xuân
khóa học tin học văn phòng tại hà nội
dịch vụ làm bảo hiểm xã hội

Scroll up

#6

RE: Stored XSS in WordPress Core - Magebay.com

in Market Section Mon Sep 18, 2017 1:58 pm
by rosejosy • 2 Posts

Thank you for sharing the code section here I searched many websites to get the code section but didn’t get any. But here you shared the complete details. Now I can try this code in my project. Keep sharing more articles. van gogh museum tour

Scroll up


Visitors
0 Members and 14 Guests are online.

We welcome our newest member: vipservice
Board Statistics
The forum has 11175 topics and 16759 posts.

Xobor Einfach ein eigenes Xobor Forum erstellen