[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 13 Apr 2015 15:00:05 -0400 (EDT)
From: cve-assign@...re.org
To: mattd@...fuzz.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
>> 1. Maybe the
>> "- add_action( 'wp_ajax_nopriv_fsb_save_order', array( $this, 'save_order' ) );"
>>
>> code change means that wp_ajax_nopriv_fsb_save_order allowed
>> bypassing intended access control, even if the attacker did not
>> supply an XSS payload.
> Yes. It wasn't intended for non-administrators to be able to adjust
> the services by executing the action.
>>
>> 2. Maybe the patched code can help to prevent a CSRF attack against
>> an authenticated action handler.
> Again, yes. Administrators could be forced to execute the action with
> an attacker's parameters via a CSRF attack. Nonces have been added to
> stop this.
Certainly the CSRF will have its own CVE ID, because it is independent
of whether (and why) wp_ajax_nopriv_fsb_save_order existed.
In this specific case, for the direct unauthenticated attacks, we feel
that there can be two CVE IDs for the two different problems with
different types of attacks, i.e., leaving the services in their
original order but including an XSS payload (CVE-2015-3299), and
moving the services to an arbitrary order but omitting an XSS payload.
These conceivably could have been (even though they weren't) fixed
independently:
add an effective approach against XSS in the input data, but
ignore the relationship between the new order values and the
original order values
versus
ensure that the order values, when compared numerically, have no
change from the original values -- but ignore trailing
non-numeric data
We will send the additional CVE IDs soon unless there is any new
information.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVLBEIAAoJEKllVAevmvms36QH/jvFVxqbjNQMB3Wis1kX2RaI
ArW32jKwavBxrGEQ5O+OJEGf6tYS27lA9YPiNKp+8Jk5NfRmXgqNOsw+YuCNcV7J
arwVDeIOPRDVmvgANdaNjHQ+fl4xTUqBGClqa0T7ZsGTXjEhkaQIJ4CjYBAulp6J
qGKohKSOCJ9UOQmPWFTD0Pr1gOykfdsF9K5w+LkVcZ3EbS8Is6hnBuOAg3EbbtQp
PZX0Z6ZykonoXQ3sTDdoqV6w6k9qvYP0YrQkKrJvmcLcKjohGyAvcjsyjXh4gEtT
mepqdUI6oGe7b6X97e3WE4wlIcz0R8VZdvZIgmQRQHtTDBzK2eNruZUCsFcfTcE=
=DRJz
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
