X / xAI · Report #218451

[Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME

Validstatus

mediumseverity

11upvotes

8 May 2017disclosed

Summary

Multiple Gnip blogs were exposed to reflected cross-site scripting by way of an outdated plupload.flash.swf WordPress component. This SWF was vulnerable to Same-Origin Method Execution. Thanks to Twitter for the swift fix, and please excuse the minor typos in the initial report!

How it was found

Hi,

The following endpoints are exposed to reflected cross-site scripting by way of a vulnerable "plupload.flash.swf" component on WordPress.

A comprehensive explanation of this vulnerability can be found on resolved report #134738:

WordPress is vulnerable against a Same-Origin Method Execution (SOME) vulnerability that stems from an insecure URL sanitization problem performed in the file plupload.flash.swf. The code in the file attempts to remove flashVars [...] but fails to do so, enabling XSS via ExternalInterface.

Proof of Concept

To reproduce this vulnerability, please access the below Proof of Concept link in the latest version of Firefox with Adobe Flash enabled. I have confirmed exploitability on Windows 7 x64.

https://blog-origin.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS&

https://blog.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS&

https://engineering.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS&

https://engineering-origin.gnip.com//wp-includes/js/plupload/plupload.flash.swf?%#target%g=alert&uid%g=XSS&

Please let me know if you require any additional information regarding this vulnerability.

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original