Democracy 2.0.1 HTML Injection Vulnerability
Intro
Democracy is a popular AJAX driven voting plugin for WordPress.
BlogSecurity found a vulnerability in the latest version of Democracy (2.0.1) that may allow attackers to hijack your admin/user accounts as well as a vast number of other attack vectors.
Proof of concept (test your blog):
http://wordpress.dom/blah’style=xss:expression(alert(document.cookie)); (Tested on IE7)
OR
http://wordpress.dom/blah’onMouseOver=javascript:alert(document.cookie);// (Testing on Firebox & IE)
This proof of concept exploits above can be used to test for vulnerable blogs.
How to fix?
Go to your democracy plugin directory and edit class.php.
Vulnerable code: in class.php (Line 166)
$url = htmlspecialchars(add_query_arg(array(’dem_action’ => ‘view’, ‘dem_poll_id’ => $this->id)));
Change to:
$url = htmlspecialchars(add_query_arg(array(’dem_action’ => ‘view’, ‘dem_poll_id’ => $this->id)), ENT_QUOTES);
Double quotes are escaped but single quotes aren’t. As single quotes are used in $url, we can append malicious code.As a fix, we simply use htmlspecialchars() with ENT_QUOTES.
Summary
The Democracy author was contacted initially on the 31 December, and then again at the beginning of last week. As we have not heard anything in over 15 days, we are releasing the advisory along with a fix.
David Kierznowski is credited for the find.
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
don’t you run the Democracy plugin on this blog? did you find this from dynamically testing or did you find it in the code?
Plugin removed after minor issues. Searching for solutions showed that this plugin has a long reputation of weird issues and author’s support is minor…
Taken the possible insecurity-issue (though fixed here) I came to my descision.
I released the original exploit a year and a half ago, so hi, welcome to the fraternity of Democracy exploit finders. We’re a small and humble bunch. ;-)
I can’t get this to work though. Maybe I’m missing something. My team has tested on all major browsers and on Macs and PCs. Can you elaborate on the trick here? Or contact me privately and we can look at some specific cases.
Aaron, you asked for it :):
Try (in IE7)
http://www.problogger.net/’style=xss:expression(alert(document.cookie));//
You may have to force close your IE afterwards though, so be prepared :)
Note: you may need to replace the single quote manually, as a direct copy and paste may not work.
[...] installed a polling plugin (and fixed it), so let’s make this a democratic process! Would you pay $20 / €18 for the extra iPod [...]