oss-sec mailing list archives
CVE-Request for stored WCI (a.k.a XSS) in Visual Form Builder 2.7.5 - 2.8.4
From: Anti Räis <antirais () gmail com>
Date: Mon, 14 Sep 2015 10:49:47 +0300
Greetings, I've discovered a vulnerability in the following component and would like to request CVE-ID for it: Product: Visual Form Builder (https://wordpress.org/plugins/visual-form-builder/) Version: 2.7.5 - 2.8.4 (according to the source code), fixed in 2.8.5 Product-type: Wordpress plugin Vendor: http://vfbpro.com/ Fixed: 2015-09-09, reported 2015-09-06 Changelog: https://plugins.trac.wordpress.org/changeset?old_path=%2Fvisual-form-builder%2Ftags%2F2.8.4&old=1244830&new_path=%2Fvisual-form-builder%2Ftags%2F2.8.5&new=1244830&sfp_email=&sfph_mail= Description: This plugin is used to create feedback forms. Unauthenticated user can submit malicious code and it is shown to the authenticated administrator in the entries page. Upon viewing the submitted entry, the attackers code executes resulting in web content injection attack (WCI, a.k.a XSS). Vulnerability: --- start visual-form-builder/includes/class-entries-detail.php --- 160 case 'textarea' : 161 case 'html' : 162 ?> 163 <tr valign="top"> 164 <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th> 165 <td style="background:#eee;border:1px solid #ddd"><?php echo wpautop( stripslashes( wp_specialchars_decode( esc_html( $obj->value ) ) ) ); ?></td> 166 </tr> 167 <?php 168 break; 169 default : 171 ?> 172 <tr valign="top"> 173 <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th> 174 <td style="background:#eee;border:1px solid #ddd"><?php echo stripslashes( wp_specialchars_decode( esc_html( $obj->value ) ) ); ?></td> 175 </tr> 176 <?php 177 break; --- end visual-form-builder/includes/class-entries-detail.php --- The vulnerability lies in the following PHP code: <?php echo stripslashes( wp_specialchars_decode( esc_html( $obj->value ) ) ); ?> The $obj->value contains user supplied data and is escaped using the esc_html() and then HTML special characters are decoded using wp_specialchars_decode() which essentially neuters the esc_html(). Finally, the stripslashes() is applied, which removes '\' from the given argument. Poc: * Submit the following value in the form's text field: \<svg/onload=alert(1) ; * authenticated administrator views the entry and executes the code Visual Form Builder -> Entries -> (attacker's entry) -> View Disclosure timeline: 2015-09-06 - discovery, contacted the developers 2015-09-08 - sent further details and requested feedback 2015-09-09 - new release with the fix was released All the best, Anti Räis
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE-Request for stored WCI (a.k.a XSS) in Visual Form Builder 2.7.5 - 2.8.4 Anti Räis (Sep 14)