WordPress Pretty Link 插件跨站脚本漏洞(CVE

发布日期:2013-02-20
更新日期:2013-02-24

受影响系统:
WordPress Pretty Link Lite 1.x
描述:
--------------------------------------------------------------------------------
BUGTRAQ  ID: 58072
 CVE(CAN) ID: CVE-2013-1636
 
Pretty Link Lite是为您网站创建短链接的插件,可以将外部的链接映射到这些短链接,并且可以跟踪链接的每一次点击,而且提供详细的报告,包括来访者ip、来访者使用的浏览器、操作系统等。

Pretty Link 1.6.3之前版本没有在正确验证wp-content/plugins/pretty-link/includes/version-2-kvasir/open-flash-chart.swf的"get-data" GET参数值,可被利用在用户浏览器会话中执行任意HTML和脚本代码。
 
<*来源:hip [Insight-Labs]
 
  链接:
 *>

测试方法:
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
hip [Insight-Labs] 给出了如下测试方法
 
# Exploit Title: Wordpress pretty-link&#8207; plugin XSS in SWF
 # Release Date: 20/02/13
 # Author: hip [Insight-Labs]
 # Contact: hip@insight-labs.org | Website:
 # Software Link:
 # Vendor Homepage:
 # Tested on: XPsp3
 # Affected version: 1.6.3 before
 # Google Dork: inurl:/wp-content/plugins/pretty-link/
 # REF:CVE-2013-1636
 -----------------------------------------------------------------------------------------------------------------------
 # Introduction:
 Pretty-link is Shrink, beautify, track, manage and share any URL on or off of your WordPress website. Create links that look how you want using your own domain name!
 -------------------------------------------------------------------------------------------------------------------------
 # XSS - Proof Of Concept:
 vulnerable path:
 /wp-content/plugins/pretty-link/includes/version-2-kvasir/open-flash-chart.swf
 vulnerabile parameter:get-data
 
POC:
 /wp-content/plugins/pretty-link/includes/version-2-kvasir/open-flash-chart.swf?get-data=(function(){alert(xss)})()
 
-------------------------------------------------------------------------------------------------------------------------
 # Patch:
 -- Vendor was notified on the 23/01/2013
 -- Vendor released version 1.6.3 on 25/01/2013 Fixed the bug
 -- REF:
 -------------------------------------------------------------------------------------------------------------------------

建议:
--------------------------------------------------------------------------------
厂商补丁:
 
WordPress
 ---------
 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
 

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/wywfys.html