[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 22 Apr 2024 12:52:17 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Wordpress Responsive theme: arbitrary HTML content injection
(CVE-2024-2848)
A Wordpress theme called "Responsive" had a vulnerability that allowed
injecting arbitrary content into the page's footer. This is fixed in
version 5.0.3.
There are active attacks exploiting this vulnerability, redirecting
page visitors to malicious websites.
If you have to cleanup an affected installation, the attack can, as
far as I understand, only set the "footer-copyright" option stored
in the options table (usually wp_options). So you can check
the fielt with option_name=footer-copyright and remove any malicious /
spammy content.
Advisory:
https://github.com/advisories/GHSA-8vpf-jx6q-39fr
Quote:
"The Responsive theme for WordPress is vulnerable to unauthorized
modification of data due to a missing capability check on the
save_footer_text_callback function in all versions up to, and
including, 5.0.2. This makes it possible for unauthenticated attackers
to inject arbitrary HTML content into the site's footer."
Upstream changelog:
https://themes.svn.wordpress.org/responsive/5.0.3/changelog.txt
"(28/03/2024) = Fix - Version 5.0.3
[...]
[!] = Fixed = Fixed the vulnerability of unauthorized modification of
footer text."
The latest version 5.0.3.1 contains another possibly relevant note in
the changelog:
"(17/04/2024) = Fix - Version 5.0.3.1
[!] = Fixed = Enhanced Security: Strengthened the codebase to further
protect your website."
I have not verified whether this is another vulnerabiltiy or just
additional hardening.
--
Hanno Böck
https://itsec.hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
