Cross-site Scripting Vulnerability in /wp-admin/setup-config

[danielmiessler]

There appears to be a vulnerability in the setup-config file whereby a user can submit script to the dbhost parameter and have it echoed back by WordPress. I have attached an image for your review.

[danielmiessler]

Screenshot of XSS

[nacin]

Too late now, but things like this should be reported to security@….

[danielmiessler]

I think I followed the correct procedure.

I went to wordpress.org, typed "report a vulnerability" into the search field, and was given instructions on how to properly fill out a trac ticket.

[danielmiessler]

Also, this should be 3.0.4 not 3.1. My fault.

[ericmann]

Replying to danielmiessler:

I think I followed the correct procedure.

No, you didn't.

I went to wordpress.org, typed "report a vulnerability" into the search field, and was given instructions on how to properly fill out a trac ticket.

The page that comes up from that search (​http://codex.wordpress.org/Reporting_Bugs) has an explicit "Reporting security issues" section that refers you to the Security FAQ page (​http://codex.wordpress.org/Security_FAQ). This section reminds you to notify the vendor (the WordPress core team) privately rather than publicly about exploits, and the Security FAQ page provides the actual contact information.

It is bad practice to report security vulnerabilities in public. We need time to patch the issue and provide an update to users before anyone who would exploit the vulnerability gets a hold of it.

[ericmann]

Replying to SergeyBiryukov:

Patch looks good. Clear, obvious fix.

[ryan]

We're protecting against someone purposefully injecting XSS into their config during setup? Why bother?

[westi]

Replying to ryan:

We're protecting against someone purposefully injecting XSS into their config during setup? Why bother?

Indeed.

If the install isn't setup yet they might as well run it for you and have the admin account ;-)