window.wp is vulnerable to DOM clobbering

[Rudloff]

(This was initially reported privately as a vulnerability but was rejected because it is theoretical with no real exploit.)

The window.wp object is defined like this in multiple JS files:

window.wp = window.wp || {}

This makes it vulnerable to DOM clobbering if an attacker can insert an HTML element with this ID:

<a id="wp"></a>

Some browsers like Chrome will automatically create a window.wp variable that points to this HTML element.

It is also possible to clobber properties of the object like this:

<a id="wp"></a><a id="wp" name="api" href="clobbered"></a>

This will automatically create a window.wp.api property that points to this element.

The impact depends on how the website uses the wp object.
In most cases it will cause a broken feature (some JS code using window.wp will break unexpectedly because a property is not defined).
This could make a specific feature unusable.

In theory it could also lead to an XSS attack if some JS code uses a value from window.wp:

$(element).html('foo' + window.wp.customText);

An XSS payload could be injected like this:

<a id="wp"></a><a id="wp" name="customText" href="http://&lt;img src=x onerror=alert()&gt;"></a>

But I could not find any plugin doing something like this.

A solution would be to ensure that window.wp is always defined.

[westonruter]

It would be a shame to always have to add an inline script even when none is required on the page. However, given that the emoji loader is present on every page and other scripts are always present, then this probably isn't a valid concern of mine.