WordPress 3.5 Issues

WordPress 3.5

WordPress released version 3.5.1 on January 24th 2013 which fixed a number of issues [0]:

Issue 1: "A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions."
Issue 2: "Two instances of cross-site scripting via shortcodes and post content."
Issue 3: "A cross-site scripting vulnerability in the external library Plupload."

Issue 1

This issue was originally discovered by @FireFart a WPScan Team member. You can find his Pingback Port Scanner here. Additional issues were also identified with the pingback API.

Issue 2

This issue was successfully investigated by @erwan_lr, a WPScan Team member. 'Administrators and Editors have the unfiltered_html capability' [1] so they are permitted to insert raw JavaScript into blog posts, less privileged users should not be allowed to insert JavaScript into blog posts, however, with these PoCs it is possible.

Instance 1

Proof of Concept: [gallery ids="20" icontag="script>alert(1)</script>"]

Instance 2

Proof of Concept: [embed]javascript:alert(document.cookie)[/embed]

Issue 3

This issue was successfully investigated by @erwan_lr, a WPScan Team member. "[Plupload] Allows you to upload files using HTML5 Gears, Silverlight, Flash, BrowserPlus or normal forms, providing some unique features such as upload progress, image resizing and chunked uploads." [2]

The vulnerable file is included in WordPress versions 3.5, 3.4.2, 3.4.1, 3.4, 3.3.3 and 3.3.2.

Proof of Concept: wp-includes/js/plupload/plupload.flash.swf?id=\"));}catch(e){alert(1);}//