Medium Risk XSS Vulnerability

  • Resolved amarie

    (@tuesdave)


    10 years, 9 months ago

    Hello.

    I had a professional security source-code audit done on my website and they found some possible XSS vulnerabilities in your plugin.

    groups\lib\admin\groups-admin-groups-add.php ln 39
    $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

    groups\lib\admin\ groups-admin-groups-remove.php ln 46 and 133
    $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

    groups\lib\admin\ groups-admin-capabilities-add.php ln 37
    $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

    groups\lib\admin\ groups-admin-capabilities-edit.php ln 44
    $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

    groups\lib\admin\groups-admin-capabilities-remove.php ln 46 and 131
    $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];

    The issue is that $_SERVER['REQUEST_URI'] is not being sanitized.

    Are there any plans to patch this in the future? Otherwise, I’ll need to maintain the plugin myself.

    Thanks for your time,

    https://wordpress.org/plugins/groups/

Viewing 1 replies (of 1 total)
  • Plugin Author Kento

    (@proaktion)

    10 years, 9 months ago

    Hi,

    Many thanks for reporting this, appropriate changes have been made and version 1.8.1 has just been released.

    Your feedback is very valuable, just a recommendation in case you have any future insights on this or other plugins. Please review http://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/ on good practices to report security vulnerabilities.

    In the interest of the community, you should disclose information about security vulnerabilities *privately* so that they can be fixed before potential attackers could use the information on sites.

    Please note that it’s not about hiding the fact that a plugin has potential security issues, but to mitigate the risk of attackers getting aware of the potential vulnerabilities and causing harm.

    Quoting from the above mentioned entry:

    It is standard practice to *responsibly and privately disclose* to the vendor (the WordPress core development team, in this case) a security problem before publicizing, so a fix can be prepared, and damage from the vulnerability minimized.

    In the case of a plugin, you could privately alert the plugin developer.

    Cheers

Viewing 1 replies (of 1 total)

The topic ‘Medium Risk XSS Vulnerability’ is closed to new replies.

Tags