Bug 659294 - Wordpress: XSS in requesting user credentials in order to connect to the filesystem
Summary: Wordpress: XSS in requesting user credentials in order to connect to the file...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 659319 668192
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-12-02 12:55 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:41 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-09-14 22:42:50 UTC
Embargoed:


Attachments (Terms of Use)

Description Jan Lieskovsky 2010-12-02 12:55:50 UTC
An improper input sanitization flaw was found in way Wordpress
requested user SSH/FTP credentials in order to connect to the
filesystem. A remote attacker, with Wordpress administrator privilege,
could use this flaw to conduct cross-site scripting (XSS) attacks
(execute arbitrary HTML or scripting code).

References:
[1] http://codex.wordpress.org/Version_3.0.2

Upstream changeset:
[2] http://core.trac.wordpress.org/changeset/16367

Comment 1 Jan Lieskovsky 2010-12-02 12:59:59 UTC
This issue affects the versions of the wordpress package, as shipped
with Fedora release of 13 and 14.

Please fix.

--

This issue affects the version of the wordpress package, as present
within EPEL-5 repository.

Please schedule and update.

Comment 2 Jan Lieskovsky 2010-12-02 14:42:22 UTC
CVE Request:
http://www.openwall.com/lists/oss-security/2010/12/02/1

Comment 3 Jan Lieskovsky 2010-12-02 14:44:53 UTC
Created wordpress tracking bugs for this issue

Affects: fedora-all [bug 659319]

Comment 4 Leonard den Ottolander 2010-12-21 12:04:51 UTC
Why does WordPress needs filesystem credentials in the first place?

http://wordpress.org/support/topic/filesystem-credentials-very-bad-practice-and-totally-unnecessary

http://pastebin.com/WsP7tabM

In his firs reply "Otto" says "Firstly, it actually does check to see that it has access to the webroot with the proper owner and group permissions first. "

This is not true. If you check the code path (wp-admin/includes/ WP_Upgrader->run(), fs_connect()) you can tell that it insists on asking for filesystem credentials (FTP or even SSH) before the actual file download (download_url() -> wp_remote_get()) is attempted. If checking those filesystem credentials fails it bombs out and never attempts to download the theme.

Then in the 5th comment he says "It's a matter of it being capable of replacing the files and having the file replacements have the same user and group ownership." He seems to be argueing the use of FTP is a convenience for when file system ownership or permissions on created files is incorrect. But no attempt is made by the application to install that downloaded file using a fwrite(), it always "falls back" to FTP.

This approach *forces* you to supply FTP credentials or no theme will be installed.


Note You need to log in before you can comment on or make changes to this bug.