Executive brief
WordPress, a popular website management and blogging platform, was found to have a security flaw in how it displays post summaries in the administrative dashboard. An attacker could use this to inject malicious scripts that execute in the browser of a site administrator. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in 'wp-admin/includes/class-wp-posts-list-table.php' within WordPress versions prior to 4.7.2. The root cause is the improper neutralization of input when rendering post excerpts in 'Excerpt' mode within the posts list table; specifically, the code used 'the_excerpt()' which did not sufficiently escape HTML entities for that context. An attacker with the ability to create or edit posts (or by tricking a user into doing so) can inject malicious JavaScript into the excerpt field. When an administrator views the posts list in excerpt mode, the script executes in their browser context. The fix involves using 'esc_html(get_the_excerpt())' to ensure the output is properly escaped.
Affected products
- WordPress WordPress < 4.7.2
Timeline
- 2017-01-26: patched: WordPress 4.7.2 released
- 2017-01-30: disclosed: NVD publication date
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/28/5
- http://www.securityfocus.com/bid/95816
- http://www.securitytracker.com/id/1037731
- https://codex.wordpress.org/Version_4.7.2
- https://github.com/WordPress/WordPress/commit/4482f9207027de8f36630737ae085110896ea849
- https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/