Versions less than 1.0.7 of the Wordpress plugin Diagnostic Tool, contain several vulnerabilities:
-
Persistent XSS in the Outbound Connections view. An attacker that is able to cause the site to request a URL containing an XSS payload will have this XSS stored in the database, and when an admin visits the Outbound Connections view, the payload will run. This can be trivially seen in example by running a query for
http://localhost/<script>alert(/xss/)</script>on that page, then refreshing the page to see the content run, as the view is not updated in real time. This is CVE-2014-4183. -
Reflected XSS in DNS resolver test page. When a reverse lookup is performed, the results of
gethostbyaddr()are inserted into the DOM unescaped. An attacker who (mis-) configures a DNS server to send an XSS payload as a reverse lookup may be able to either trick the administrator into performing a lookup, or (more likely) use the CSRF vulnerability documented below to trigger the XSS. -
AJAX handlers do not have any CSRF protection on them. This allows an attacker to trigger the server into sending test emails (low severity), perform DNS lookups (high severity when combined with the reflected XSS above) and request the loading of pages by the server (including URLs that contain XSS payloads, triggering the persistent XSS documented above). Additionally, the last 2 vulnerabilities could be used to trigger an information leak for Wordpress servers that are behind a DDoS protection service (e.g., Cloudflare) or are being run as TOR anonymous services by forcing the server to request a page from the attacker’s server or perform a DNS query against the attackers DNS server, allowing the attacker to learn the real IP of the server hosting Wordpress. This is CVE-2014-4182.
Timeline:
- 2014/06/15: Vulnerabilities discovered & reported to developers.
- 2014/06/30: Developers release Diagnostic Tool 1.0.7, fixing issues.
- 2014/07/04: Public disclosure.