Yoast GA Plugin for WP - Cross Site Scripting Vulnerability - 14 views

• 
  #1 David McCart on 04 Dec 09

   

  Yoast GA Plugin for WP - Cross Site Scripting Vulnerability
  
  Version Affected: 3.2.4 (newest)
  
  Info: The Google Analytics for WordPress plugin automatically tracks and
  segments all outbound links from within posts, comment author links, links
  within comments, blogroll links and downloads. It also allows you to track
  AdSense clicks, add extra search engines, track image search queries and it
  will even work together with Urchin.
  
  Credits: InterN0T
  
  External Links:
  http://yoast.com/wordpress/google-analytics/
  
  
  -:: The Advisory ::-
  On line 353 in googleanalytics.php the following vulnerable code was identified:
  /**
  * If this is a 404 page, track the 404 and prevent all other stuff as it's not needed.
  */
  if ( is_404() ) {
  echo "\t\t".'pageTracker._trackPageview("/404.html?page=" + document.location.pathname + document.location.search + "&from=" + document.referrer);'."\n";
  echo "\t".'} catch(err) {}'."\n";
  echo '</script>'."\n";
  } else if ($wp_query->is_search && $wp_query->found_posts == 0) {
  echo "\t\t".'pageTracker._trackPageview("'.get_bloginfo('url').'/?s=no-results: '.$wp_query->query_vars['s'].'&cat=no-results");'."\n";
  echo "\t".'} catch(err) {}'."\n";
  echo '</script>'."\n";
  
  In order to trigger this bug, a 404 (Not Found) message must be the response when supplying the XSS code into the search-form.
  
  One can either end the script tag or use javascript in order to abuse this issue.
  
  
  Proof of Concept's:
  A. </script>alert(0)</script>
  B. ");alert(0);document.write("
  
  Example:
  A. hxxp://localhost/wp/?s=</script><script>alert(0)</script>
  B. hxxp://localhost/wp/?s=");alert(0);document.write("
  
  If magic_quotes is enabled inside php.ini, Proof of Concept (B) wont work.
  
  
  -:: Solution ::-
  The following patch was supplied to the vendor:
  
  On line 361 in googleanalytics.php the following piece of code is vulnerable to Cross Site Scripting:
  echo "\t\t".'pageTracker._trackPageview("'.get_bloginfo('url').'/?s=no-results: '.$wp_query->query_vars['s'].'&cat=no-results");'."\n";
  
  In order to prevent this, One will have to use f.ex. htmlentities or rawurlencode to secure it:
  echo "\t\t".'pageTracker._trackPageview("'.get_bloginfo('url').'/?s=no-results: '.rawurlencode($wp_query->query_vars['s']).'&cat=no-results");'."\n";
  
  The reason why we thought rawurlencode might be suitable is because htmlentities in a tracking URL might break the Google Analytics Tracking.
  
  
  Disclosure Information:
  - Vulnerability found 3rd December
  - Patch was made available 4th December
  - Disclosed on InterN0T 4th December
  - Vendor and Buqtraq (SecurityFocus) contacted the 4th December
  
  
  All of the best,
  MaXe
  
  No virus found in this incoming message.
  Checked by AVG - www.avg.com
  Version: 9.0.709 / Virus Database: 270.14.91/2542 - Release Date: 12/03/09 19:36:00

   

  <div class="cArrow"> </div><div class="cContentInner">Yoast GA Plugin for WP - Cross Site Scripting Vulnerability <br /> <br /> Version Affected: 3.2.4 (newest) <br /> <br /> Info: The Google Analytics for WordPress plugin automatically tracks and <br /> segments all outbound links from within posts, comment author links, links <br /> within comments, blogroll links and downloads. It also allows you to track <br /> AdSense clicks, add extra search engines, track image search queries and it <br /> will even work together with Urchin. <br /> <br /> Credits: InterN0T <br /> <br /> External Links: <br /> <a href="http://yoast.com/wordpress/google-analytics/" rel="nofollow" target="_blank">http://yoast.com/wordpress/google-analytics/</a> <br /> <br /> <br /> -:: The Advisory ::- <br /> On line 353 in googleanalytics.php the following vulnerable code was identified: <br /> /** <br /> * If this is a 404 page, track the 404 and prevent all other stuff as it's not needed. <br /> */ <br /> if ( is_404() ) { <br /> echo "\t\t".'pageTracker._trackPageview("/404.html?page=" + document.location.pathname + document.location.search + "&from=" + document.referrer);'."\n"; <br /> echo "\t".'} catch(err) {}'."\n"; <br /> echo '</script>'."\n"; <br /> } else if ($wp_query->is_search && $wp_query->found_posts == 0) { <br /> echo "\t\t".'pageTracker._trackPageview("'.get_bloginfo('url').'/?s=no-results: '.$wp_query->query_vars['s'].'&cat=no-results");'."\n"; <br /> echo "\t".'} catch(err) {}'."\n"; <br /> echo '</script>'."\n"; <br /> <br /> In order to trigger this bug, a 404 (Not Found) message must be the response when supplying the XSS code into the search-form. <br /> <br /> One can either end the script tag or use javascript in order to abuse this issue. <br /> <br /> <br /> Proof of Concept's: <br /> A. </script>alert(0)</script> <br /> B. ");alert(0);document.write(" <br /> <br /> Example: <br /> A. hxxp://localhost/wp/?s=</script><script>alert(0)</script> <br /> B. hxxp://localhost/wp/?s=");alert(0);document.write(" <br /> <br /> If magic_quotes is enabled inside php.ini, Proof of Concept (B) wont work. <br /> <br /> <br /> -:: Solution ::- <br /> The following patch was supplied to the vendor: <br /> <br /> On line 361 in googleanalytics.php the following piece of code is vulnerable to Cross Site Scripting: <br /> echo "\t\t".'pageTracker._trackPageview("'.get_bloginfo('url').'/?s=no-results: '.$wp_query->query_vars['s'].'&cat=no-results");'."\n"; <br /> <br /> In order to prevent this, One will have to use f.ex. htmlentities or rawurlencode to secure it: <br /> echo "\t\t".'pageTracker._trackPageview("'.get_bloginfo('url').'/?s=no-results: '.rawurlencode($wp_query->query_vars['s']).'&cat=no-results");'."\n"; <br /> <br /> The reason why we thought rawurlencode might be suitable is because htmlentities in a tracking URL might break the Google Analytics Tracking. <br /> <br /> <br /> Disclosure Information: <br /> - Vulnerability found 3rd December <br /> - Patch was made available 4th December <br /> - Disclosed on InterN0T 4th December <br /> - Vendor and Buqtraq (SecurityFocus) contacted the 4th December <br /> <br /> <br /> All of the best, <br /> MaXe <br /> <br /> No virus found in this incoming message. <br /> Checked by AVG - <a href="http://www.avg.com" rel="nofollow" target="_blank">www.avg.com</a> <br /> Version: 9.0.709 / Virus Database: 270.14.91/2542 - Release Date: 12/03/09 19:36:00</div>

  ...

  Cancel

To Top