Executive brief
MediaElement.js is a popular media player library used by content management systems like WordPress and Contao to handle video and audio. A security flaw in its Flash component allows attackers to perform 'Reflected Cross-Site Scripting' (XSS) by tricking a user into clicking a malicious link. If successful, an attacker could execute unauthorized scripts in the user's browser, potentially leading to the theft of session cookies, account takeover, or the defacement of the website.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the 'flash/FlashMediaElement.as' (and compiled .swf) component of MediaElement.js. The root cause is an ineffective sanitization routine that attempts to strip GET parameters from 'flashVars' to prevent external manipulation of 'ExternalInterface' calls. Attackers can bypass this protection using an obfuscated parameter name (e.g., 'jsinitfunctio%gn') to inject arbitrary JavaScript. This vulnerability was widely distributed via its inclusion in WordPress (versions 4.2 through 4.5.1) and Contao. Exploitation requires a victim to visit a specially crafted URL. The issue is resolved in MediaElement.js version 2.21.0 and later.
Affected products
- John Dyer MediaElement.js < 2.21.0
- WordPress WordPress 4.2 - 4.5.1
- Contao Contao 3.0.0 - 3.5.14
Timeline
- 2016-04-01: disclosed: Reported to WordPress via HackerOne by Cure53 team
- 2016-05-06: patched: WordPress 4.5.2 released with fix
- 2016-05-17: advisory: GitHub Advisory published
- 2016-07-15: patched: Contao 3.5.15 released with fix
References
- https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e
- https://github.com/mediaelement/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e
- https://codex.wordpress.org/Version_4.5.2
- https://contao.org/en/news/contao-3_5_15.html
- https://core.trac.wordpress.org/changeset/37371
- https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c