what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress 404 To 301 2.2.8 Cross Site Scripting

WordPress 404 To 301 2.2.8 Cross Site Scripting
Posted Nov 9, 2016
Authored by Securify B.V., Alyssa Milburn

WordPress 404 to 301 plugin version 2.2.8 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | caf5fe4e82197491c2d860c9c6183c6cfbe9f3b073eb49cb2472f0de886a1e21

WordPress 404 To 301 2.2.8 Cross Site Scripting

Change Mirror Download
------------------------------------------------------------------------
Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin
------------------------------------------------------------------------
Alyssa Milburn <amilburn.at.zall.org>, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A stored Cross-Site Scripting vulnerability was found in the 404 to 301
WordPress Plugin. This issue can be exploited by an anonymous user and
allows an attacker to perform a wide variety of actions, such as
stealing users' session tokens, or performing arbitrary actions on their
behalf.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160719-0003

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on 404 to 301 WordPress Plugin
version 2.2.8.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in 404 to 301 WordPress Plugin version 2.3.1.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_404_to_301_wordpress_plugin.html

The vulnerability exists in the file admin/class-404-to-301-logs.php, which fails to correctly escape user-controlled strings which are output in HTML tables containing logs shown to site administrators, such as the Referer (ref) and User-Agent (ua) fields.

In order to exploit this issue, after an attack attempt has been made, an administrator must view the logs (via the WordPress administration console) provided by the plugin, by clicking '404 Error Logs'.
Proof of concept

Submit an HTTP request to a non-existent URL (to trigger the 404 handler) containing a header such as one of the following:

Referer: "<iframe src=/></iframe>
User-Agent: "<script>alert(/hi/);</script>

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close