Webappsecurity’s Weblog

XSS – Nextgen gallery 0.96 wordpress plugin

Posted in websecurity by webappsecurity on June 8, 2008

Bom, esse post e dedicado a esse XSS que encontrei no modoulo nextgen do wordpress, sua amplitude nao e tao grande devido a ser um XSS dentro do modulo de admin, porem so reforca que a checagem de todas as entradas e extremamente necessaria! :)

==============================

XSS – Nextgen gallery 0.96 wordpress plugin

==============================

Author: Eduardo Neves a.k.a _eth0_
Date: 07 june 2008
Site: webappsecurity.wordpress.com

—————————————

APPLICATION : Nextgen gallery 
VERSION : <= 0.96
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/

—————————————

IMPACT: XSS, XSRF, etc….

—————————————

Description:

This vulnerability can be explored writing in the descritption textbox a mailicous (or not) code

link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed

In the description textbox write the text:

<script>alert(‘xss’);</script>

And when the gallery was posted, user click in photo and the script was executed!

Some pictures:

 

 

8 comments

8 Responses

Subscribe to comments with RSS.

  1. Alex Rabe said, on June 8, 2008 at 7:16 am

    Are you able to access to the page without admin access ? I’m not able to enter this code , when I have no access to the admin section

    Reply
  2. webappsecurity said, on June 8, 2008 at 1:02 pm

    This code is inserte in inserted in admin page, to “explore” it is necessary a admin privilege!

    Reply
  3. Alex Rabe said, on June 8, 2008 at 2:06 pm

    Ok, you can insert the same code into a post/page. Is this also a XSS ? It was my intention to allow in description field html code, I don’t see any issue as long no evil person have access to your blog, or I’m wrong ?

    Reply
  4. webappsecurity said, on June 8, 2008 at 2:16 pm

    A possibility to execute scripts is not a best pratice to code, this error have a lowest impact, because this only can be reproduced by a site adminsitrator. If your intention is html code, use an escape to not allow script execution in IMHO.

    Reply
  5. Alex Rabe said, on June 8, 2008 at 2:37 pm

    Ok,thanks to point this out. I will consider a update in the next release

    Reply
  6. Sp0oKeR said, on June 8, 2008 at 4:08 pm

    This flaw we could use CSRF and send some malicious URL to the wordpress admin and hijacking the cookie session. Not an easy stuff but it’s possible .

    Good job eth0 =)

    Regards

    Reply
  7. eti said, on June 10, 2008 at 9:18 am

    This is still bad if you allow users to add/edit images in the gallery.

    Reply
  8. Moriah said, on November 10, 2008 at 6:36 pm

    Thanks for writing this.

    Reply

Leave a Reply