• Skip to primary navigation
  • Skip to content
  • Skip to primary sidebar
  • Skip to footer

Sucuri Blog

Website Security News

  • Products
    • Website Security Platform
    • Website Firewall (WAF)
    • Enterprise Website Security
    • Multisite Solutions
  • Features
    • Detection
    • Protection
    • Performance
    • Response
    • Backups
  • Partners
    • Agency Solutions
    • Partners
    • Referral Program
    • Ecommerce
  • Resources
    • Guides
    • Webinars
    • Infographics
    • SiteCheck
    • Reports
    • Email Courses
  • Immediate Help
  • Login
WordPress Vulnerability Detail

Stored XSS Patched in WordPress 5.1.1

March 26, 2019Marc-Alexandre Montpas

Security Risk: Dangerous

DREAD Score: 7.4

Vulnerability: XSS via CSRF

Patched Version: 5.1.1

38
SHARES
FacebookTwitterSubscribe

WordPress recently released an update, 5.1.1, which patches a stored XSS vulnerability in the platform’s comment system. Even 10 days after the release of this security patch, around 60% of all WordPress sites scanned by our services didn’t have this fix applied.

We are not aware of any exploit attempts using the vulnerability currently.

Should I Panic?

This vulnerability requires some level of social engineering to be exploited, and as such it may seem like this attack would be very hard to perform. But history has shown us that bad actors are very effective at spamming WP blogs using similar techniques. All the traditional phishing techniques, some we even see in the wild, may be used as well.

With the market share WordPress has, thinking a certain number of site owners may fall to such techniques certainly isn’t a far fetched idea. You should update to the latest version as soon as possible.

How Does the Stored XSS Work in WordPress?

This bug can be exploited by chaining two attacks: a Cross-Site Request Forgery (CSRF) bug and a Cross Site Scripting (XSS) vulnerability. The reason for that, is the code vulnerable to XSS may only be executed when a user with at least Editor privileges is logged in.

In order for an attack to be successful, the attacker must then trick that user logged onto his site to click a malicious link. This may be more likely to happen if, for example, he posts a comment that contains the link on the targeted site.

Once he clicks on that link, a rogue script will perform a Cross-Site-Request-Forgery attack to make the administrator’s browser post a new comment, exploiting the XSS bug on his site.

The XSS vulnerable snippet, in the wp_rel_nofollow_callback function
The XSS vulnerable snippet, in the wp_rel_nofollow_callback function

As explained by the researchers who found the issue, the vulnerability can be seen in the above snippet. The wp_rel_nofollow_callback function is applied on hyperlinks in newly created comments and mistakenly assumed all of its attributes were using double quotes. This is an issue for two reasons:

  1. Single quotes may be used too, making it possible to pass an attribute between single quotes that contained a double quote, thus breaking the generated hyperlink
  2. This function is using shortcode_parse_atts, which as we’ve discovered in past vulnerability disclosures allows some unusual tricks to be performed, like decoding C escape sequences within the attribute’s content. This would basically make it possible to pass a double-quoted attribute containing another unsanitized double-quote, achieving the same result.

If the attack is successfully executed, a malicious JavaScript payload will, behind the scene, execute and use the administrator’s browser session to store a backdoor on the site.

Conclusion

To protect against this vulnerability, we strongly encourage you to update to WordPress 5.1.1 as soon as possible.

In the event that you can’t update right away, you can leverage the Sucuri Firewall or equivalent technology to virtually patch the vulnerability.

38
SHARES
FacebookTwitterSubscribe

Categories: Vulnerability Disclosure, WordPress SecurityTags: XSS

About Marc-Alexandre Montpas

Marc-Alexandre Montpas is Sucuri’s Senior Security Analyst who joined the company in 2014. Marc’s main responsibilities include reversing security patches and scavenging vulnerabilities, old and new. His professional experience covers eight years of finding bugs in open-source software. When Marc isn’t breaking things, you might find him participating in a hacking CTF competition. Connect with him on Twitter.

Reader Interactions

Primary Sidebar

Socialize With Sucuri

We're actively engaged across multiple platforms. Follow us and let's connect!

  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Instagram
  • RSS Feed

WordPress Security Course

How to Clean a Hacked Website Guide

WordPress Security Guide

Join Over 20,000 Subscribers!

Footer

Products

  • Website Firewall
  • Website AntiVirus
  • Website Backups
  • WordPress Security
  • Enterprise Services

Solutions

  • DDos Protection
  • Malware Detection
  • Malware Removal
  • Malware Prevention
  • Blacklist Removal

Support

  • Blog
  • Knowledge Base
  • SiteCheck
  • Research Labs
  • FAQ

Company

  • About
  • Media
  • Events
  • Employment
  • Contact
  • Testimonials
  • Facebook
  • Twitter
  • LinkedIn
  • Instagram

Customer Login

Sucuri Home

  • Terms of Use
  • Privacy Policy
  • Frequently Asked Questions

© 2021 Sucuri Inc. All rights reserved

Sucuri Cookie Policy
See our policy>>

Our website uses cookies, which help us to improve our site and enables us to deliver the best possible service and customer experience.