Executive brief
b2evolution is a content management system used for hosting blogs and websites. A security flaw in how the system handles file uploads allows registered users to upload malicious Flash files. If an administrator or another visitor views a page containing these files, an attacker could execute unauthorized scripts in their browser, potentially leading to account takeover or the theft of sensitive session information.
Technical details
Multiple stored cross-site scripting (XSS) vulnerabilities exist in b2evolution through version 6.8.3. The root cause is an insecure upload policy in the file types table that allows authenticated users to upload Adobe Flash (.swf) files for use in comment or avatar frames. Because these files are subsequently rendered via the flowplayer_plugin without adequate sanitization, an attacker can embed malicious ActionScript within the SWF file to execute arbitrary JavaScript in the context of the victim's browser session. This requires the attacker to have basic authenticated access to post comments or update a profile. A patch was released to restrict SWF uploads to administrators only.
Affected products
- b2evolution b2evolution through 6.8.3
Timeline
- 2017-01-14: disclosed: Issue reported on GitHub
- 2017-01-15: advisory: NVD published CVE-2017-5494
- 2017-01-15: patched: Fix committed to b2evolution repository