Over the course of one week I had the opportunity to audit two hacked WordPress websites. I could quickly discover two vulnerabilities: a Cross Site Scripting, or XSS, in a premium WordPress theme
Akal, and a
SQL injection Denial-of-Service in a later to be disclosed plugin. This post describes the Akal theme XSS vulnerability.
Continue reading “WordPress advisory: Akal premium theme XSS vulnerability & abandonded”
Security researcher Kacper Szurek reported a reflected XSS vulnerability in the current version of Wordfence. The CVSS scoring mechanism rates the severity of this XSS vulnerability as medium. A Wordfence update 6.1.7 is released to address the XSS vulnerability.
Continue reading “XSS Vulnerability in Wordfence 6.1.1 to 6.1.6”
WordPress 4.5.2 – a security release – is just released tonight. WordPress 4.5.2 fixes a vulnerability through Plupload, the third-party library WordPress uses for uploading files.
Continue reading “WordPress 4.5.2 Security Release”
Sucuri reports an stored cross site scripting (XSS) vulnerability in Magento CE <220.127.116.11 and Magento EE <18.104.22.168. This vulnerability affects almost every install of these versions, time to upgrade your Magento webshop!
Continue reading “Security Advisory: Stored XSS in Magento”
Marcin Probola conducted a PHP static code analysis of the top ~1000 WordPress plugins, and the results showed 103 plugins were vulnerable to at least one vulnerability type (XSS, SQL injection). This is roughly 10 percent! Marcin Probola writes that scanning results were manually verified in his spare time and delivered to official firstname.lastname@example.org from 04.07.2015 to 31.08.2015. Most of reported plugins are already patched, some are not. Vulnerable and not patched plugins are already removed from official wordpress plugin repository.
Continue reading “10% WordPress plugins in top ~1000 is vulnerable, a PHP static code analysis shows”
TheCartPress eCommerce Shopping Cart – a popular WordPress e-commerce plugin that is actively used on over 5,000 websites – contains high-risk vulnerabilities that can be exploited to compromise customers’ data, execute arbitrary PHP code, and perform Cross-Site Scripting attacks against users of WordPress installations, claim High-Tech Bridge researchers. Users are advised to disable or remove the plugin.
Continue reading “High-risk vulnerabilities in TheCartPress leaves WordPress sites at risk”
Where the Vevida Optimizer WordPress plugin kept plugins on all my WordPress sites up-to-date: Sucuri reports that multiple WordPress plugins are vulnerable to Cross-site Scripting (XSS) due to the misuse of the
remove_query_arg() functions. These are popular functions used by developers to modify and add query strings to URLs within WordPress. If you haven’t configured automatic updates for WordPress plugins, please update NOW!
Continue reading “XSS Vulnerability Affecting Multiple WordPress Plugins”
prettyPhoto DOM based XSS on Saotn.org… This evening, after tweeting about preventing cross site scripting vulnerabilities, I received a reply from Olivier Beg. His reply to my tweet contained an image, as you can see above. He alerted me that Saotn.org was vulnerable to a DOM based XSS vulnerability, hidden in prettyPhoto used by my WordPress theme. Whoops! So, I had work to do! But, what is prettyPhoto and what exactly is a DOM based XSS?
Continue reading “prettyPhoto DOM based XSS”
Finbar Ryan writes in his blog post Asp.Net Application Security: “I was recently helping a colleague with a customer who was running a security check against their IIS Server on Windows Server 2008. The security tool they used highlighted that the server was running Asp.Net and might be vulnerable to cross-site scripting attacks. The Asp.Net engine does validate every request that comes in. We do however recommend that you still ensure your application is not susceptible to the scripting attacks that are out there…
Defend Against Cross-Site Scripting Using The HTML Encode Shortcuts. The .NET 4.0 & 4.5 frameworks introduced new syntax shortcuts to HTML encode dynamic content being rendered to the browser. These shortcuts provide an easy way to protect against Cross-Site Scripting (XSS) attacks in the newer versions of the .NET framework.
Continue reading “WhatWorks in AppSec: ASP.NET Defend Against Cross-Site Scripting Using The HTML Encode Shortcuts”
Een cross site scripting beveiligingsprobleem maakt het mogelijk om bepaalde, vaak kwalijke code uit te voeren in de browser-context van de bezoeker. Dat wil zeggen: als een scriptkiddie speciale code in een website weet te verbergen, dan kan hij daarmee bijvoorbeeld het cookie van een onwetende bezoeker stelen. Cookies bevatten vaak inlog- en sessiegegevens (autorisaties). Dit artikel laat zien, en geeft praktische tips over, hoe we cross site scripting beveiligingsproblemen tegen kunnen gaan. Dus hoe we een website beveiligen tegen cross site scripting.
Continue reading “Cross site scripting (XSS) beveiligingsproblemen tegengaan in websites”
How to use a
.htaccess file as a Web Application Firewall (WAF), and block out exploits and rogue HTTP requests. Sometimes you have no choice but to protect your website yourself, for example if your hosting provider doesn’t offer a Web Application Firewall (WAF)  security solution.
Continue reading “7 Tips: .htaccess as Web Application Firewall (WAF) to secure your website”