Date: Sat, 2 May 2015 10:51:24 +1200 From: Matthew Daley <mattd@...fuzz.com> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE request / Advisory: Slideshow (Wordpress plugin) - Wordpress option value disclosure I'd like to request a CVE ID for this issue. This is the first such request; this message serves as an advisory as well. Affected software: Slideshow (Wordpress plugin) Affected versions: 2.2.8 - 2.2.21 Website: https://wordpress.org/plugins/slideshow-jquery-image-gallery/ Reported by: Matthew Daley Description: The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function, accessible by unauthenticated users as an AJAX action, can be abused to force the disclosure of arbitrary Wordpress option values. The function is intended to return the content of a user-specified slideshow stylesheet, whether it be an administrator-created custom one or a default one included with the plugin. Custom stylesheets are stored as Wordpress option values, so the function first looks for an option matching the user-specified stylesheet name. If a matching option is found, its value is returned as the stylesheet content. However, the function does not validate the user-specified stylesheet name before this option lookup is performed (apart from sanitizing certain characters using the filter_input function). Hence, it is possible to specify any option name in place of an actual custom stylesheet name, regardless of whether the option is for the Slideshow plugin, another plugin, a theme, or Wordpress itself. Doing so will cause the function to retrieve the value of the user-specified option and output it to the user. Fixed version: 2.2.22 Fix: https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04 Changelog: https://wordpress.org/plugins/slideshow-jquery-image-gallery/changelog/ - Matthew Daley
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ