Microsoft Vulnerability Research Advisory MSVR11-010

Vulnerability in WordPress Could Allow Cross-Domain Script Execution

Published: August 16, 2011

Version: 1.0

Overview

Executive Summary

Microsoft is providing notification of the discovery and remediation of a vulnerability affecting WordPress version 3.1.2 and earlier, both as the cloud service from WordPress.com as well as the installable software available from WordPress.org. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, WordPress. WordPress has remediated the vulnerability.

A vulnerability exists in the way that WordPress previously implemented protection against cross site scripting and content-type validation. An attacker could exploit this vulnerability to achieve script execution.

Microsoft Vulnerability Research reported this issue to and coordinated with WordPress to ensure remediation of this issue. For information on this issue from WordPress, please see WordPress News: WordPress 3.1.3 (and WordPress3.2 Beta 2)

Mitigating Factors

• An attacker who successfully exploited this vulnerability could execute scripts on other parties' WordPress blogs in the same domain. In order for this attack to be successful all targets require an active and authenticated session with the target blog.

Advisory Details

Purpose and Recommendation

Purpose of Advisory: To notify users of a vulnerability and its remediation.

Advisory Status: Advisory published.

Recommendation: Review the Suggested Actions section and configure as appropriate.

Issue References

For more information about this issue, see the following references:

Affected and Non-Affected Software

This advisory discusses the following software.

Frequently Asked Questions

What is the scope of this advisory?
This advisory is part of a coordinated release with affected vendors to inform customers of a security issue that may affect their systems.

Is this a security vulnerability that requires Microsoft to issue a security update?
No. This vulnerability has been fixed via an update from the affected third-party vendors. The update remediates the software listed in the table, Affected Software.

What is the scope of the vulnerability?
This is a cross site scripting vulnerability that could allow scripts to execute on other WordPress sites sharing the same domain.

What causes the vulnerability?
The vulnerability exists in the way that WordPress handles cookies and validates the content type of imported files.

What might an attacker use this vulnerability to do?
An attacker who successfully exploited this vulnerability could execute scripts on other parties' WordPress blogs in the same domain. In order for this attack to be successful all targets require an active and authenticated session with the target blog.

How could an attacker exploit the vulnerability?
Exploitation of this vulnerability requires that a user visit a specially crafted WordPress blog on the same domain.

When this advisory was issued, had this vulnerability been publicly disclosed?
No. Microsoft reported this vulnerability to the affected third-party vendor through coordinated vulnerability disclosure.

When this advisory was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this advisory was originally issued.

Suggested Actions

Users of the blogging service on WordPress.com do not have to take any action as WordPress has remediated this vulnerability.

Users of blogging software from WordPress.org should upgrade to a version that is not affected by this vulnerability. For information on this issue from WordPress, please see WordPress News: WordPress 3.1.3 (and WordPress3.2 Beta 2).

Acknowledgments

Microsoft thanks the following:

• Richard Lundeen and Jesse Ou of Microsoft for discovering this issue and the team at WordPress for working toward a resolution.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

• V1.0 (August 16, 2011): Advisory published.

Built at 2014-04-18T13:49:36Z-07:00