Cache Poisoning and Stored Cross-Site Scripting in WP Supercache

Skrevet den af i WP Supercache

WP Super Cache stores the CDN URL and CNAME settings unescaped and substitutes them into the src/href attribute of every rewritten asset URL, so a value containing a quote or an angle bracket breaks out of the attribute and executes script for every visitor. String settings and direct-page paths are written to the cache config file as raw PHP source, so a value carrying a quote or a trailing backslash corrupts a file that is included before WordPress boots. Separately, the auth-cookie scan stopped at the first cookie whose name is falsy, so a visitor sending a cookie named “0” was treated as anonymous and the logged-in page rendered for them was written to the public cache and served to everyone.

This vulnerability affects the following application versions:

  • WP Supercache 1.7.1
  • WP Supercache 1.7.2
  • WP Supercache 1.7.3
  • WP Supercache 1.7.4
  • WP Supercache 1.7.5
  • WP Supercache 1.7.6
  • WP Supercache 1.7.7
  • WP Supercache 1.7.8
  • WP Supercache 1.7.9
  • WP Supercache 1.8
  • WP Supercache 1.9
  • WP Supercache 1.9.1
  • WP Supercache 1.9.2
  • WP Supercache 1.9.2-beta
  • WP Supercache 1.9.2-beta2
  • WP Supercache 1.9.2-beta3
  • WP Supercache 1.9.3
  • WP Supercache 1.9.3-beta
  • WP Supercache 1.9.4
  • WP Supercache 1.9.4-beta
  • WP Supercache 1.10.0
  • WP Supercache 1.10.0-beta
  • WP Supercache 1.11.0
  • WP Supercache 1.12.0
  • WP Supercache 1.12.1
  • WP Supercache 1.12.2
  • WP Supercache 1.12.3
  • WP Supercache 1.12.4
  • WP Supercache 2.0.0
  • WP Supercache 2.0.0-beta
  • WP Supercache 2.0.1
  • WP Supercache 3.0.0
  • WP Supercache 3.0.1
  • WP Supercache 3.0.2
  • WP Supercache 3.0.3
  • WP Supercache 3.1.0
  • WP Supercache 3.1.1

XSS in CDN and preload pages

Skrevet den af i WP Supercache

The HTML render is not properly escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

  • WP Supercache 0.9.9.7
  • WP Supercache 0.9.9.8
  • WP Supercache 0.9.9.9
  • WP Supercache 1.0
  • WP Supercache 1.0.1
  • WP Supercache 1.1
  • WP Supercache 1.1.1
  • WP Supercache 1.2
  • WP Supercache 1.2.1
  • WP Supercache 1.3
  • WP Supercache 1.3.1
  • WP Supercache 1.3.2
  • WP Supercache 1.3.3
  • WP Supercache 1.4
  • WP Supercache 1.4.1
  • WP Supercache 1.4.2
  • WP Supercache 1.4.3
  • WP Supercache 1.4.4
  • WP Supercache 1.4.5
  • WP Supercache 1.4.6
  • WP Supercache 1.4.7
  • WP Supercache 1.4.8
  • WP Supercache 1.4.9
  • WP Supercache 1.5.0
  • WP Supercache 1.5.1
  • WP Supercache 1.5.2
  • WP Supercache 1.5.3
  • WP Supercache 1.5.4
  • WP Supercache 1.5.5
  • WP Supercache 1.5.6
  • WP Supercache 1.5.7
  • WP Supercache 1.5.7.1
  • WP Supercache 1.5.8
  • WP Supercache 1.5.9
  • WP Supercache 1.6.0
  • WP Supercache 1.6.1
  • WP Supercache 1.6.2
  • WP Supercache 1.6.3
  • WP Supercache 1.6.4
  • WP Supercache 1.6.5
  • WP Supercache 1.6.6
  • WP Supercache 1.6.7
  • WP Supercache 1.6.8
  • WP Supercache 1.6.9
  • WP Supercache 1.7.0
  • WP Supercache 1.7.1
  • WP Supercache 1.7.2
  • WP Supercache 1.7.3
  • WP Supercache 1.7.4
  • WP Supercache 1.7.5
  • WP Supercache 1.7.6
  • WP Supercache 1.7.7
  • WP Supercache 1.7.8
  • WP Supercache 1.7.9
  • WP Supercache 1.8
  • WP Supercache 1.9
  • WP Supercache 1.9.1
  • WP Supercache 1.9.2
  • WP Supercache 1.9.2-beta
  • WP Supercache 1.9.2-beta2
  • WP Supercache 1.9.2-beta3
  • WP Supercache 1.9.3
  • WP Supercache 1.9.3-beta
  • WP Supercache 1.9.4
  • WP Supercache 1.9.4-beta
  • WP Supercache 1.10.0
  • WP Supercache 1.10.0-beta
  • WP Supercache 1.11.0
  • WP Supercache 1.12.0
  • WP Supercache 2.0.0-beta

Enhanced string escaping in view

Skrevet den af i WP Supercache

Some page views in WP Supercache are not properly escaped to prevent an XSS attack.

This vulnerability affects the following application versions:

  • WP Supercache 1.4
  • WP Supercache 1.4.1
  • WP Supercache 1.4.2
  • WP Supercache 1.4.3
  • WP Supercache 1.4.4
  • WP Supercache 1.4.5
  • WP Supercache 1.4.6
  • WP Supercache 1.4.7
  • WP Supercache 1.4.8
  • WP Supercache 1.4.9
  • WP Supercache 1.5.0
  • WP Supercache 1.5.1
  • WP Supercache 1.5.2
  • WP Supercache 1.5.3
  • WP Supercache 1.5.4
  • WP Supercache 1.5.5
  • WP Supercache 1.5.6
  • WP Supercache 1.5.7
  • WP Supercache 1.5.7.1
  • WP Supercache 1.5.8
  • WP Supercache 1.5.9
  • WP Supercache 1.6.0
  • WP Supercache 1.6.1
  • WP Supercache 1.6.2
  • WP Supercache 1.6.3
  • WP Supercache 1.6.4
  • WP Supercache 1.6.5
  • WP Supercache 1.6.6
  • WP Supercache 1.6.7
  • WP Supercache 1.6.8
  • WP Supercache 1.6.9
  • WP Supercache 1.7.0
  • WP Supercache 1.7.1
  • WP Supercache 1.7.2
  • WP Supercache 1.7.3
  • WP Supercache 1.7.4
  • WP Supercache 1.7.5
  • WP Supercache 1.7.6
  • WP Supercache 1.7.7
  • WP Supercache 1.7.8
  • WP Supercache 1.7.9
  • WP Supercache 1.8
  • WP Supercache 1.9
  • WP Supercache 1.9.1
  • WP Supercache 1.9.2
  • WP Supercache 1.9.2-beta
  • WP Supercache 1.9.2-beta2
  • WP Supercache 1.9.2-beta3
  • WP Supercache 1.9.3
  • WP Supercache 1.9.3-beta
  • WP Supercache 1.9.4
  • WP Supercache 1.9.4-beta
  • WP Supercache 1.10.0
  • WP Supercache 1.10.0-beta
  • WP Supercache 1.11.0
  • WP Supercache 2.0.0-beta

Added checks in settings page to prevent authenticated remote code execution (RCE)

Skrevet den af i WP Supercache

Missing path checks could allow an adversary to upload and execute malicious code with the goal of gaining control of the site.

This vulnerability affects the following application versions:

  • WP Supercache 1.4.5
  • WP Supercache 1.4.6
  • WP Supercache 1.4.7
  • WP Supercache 1.4.8
  • WP Supercache 1.4.9
  • WP Supercache 1.5.0
  • WP Supercache 1.5.1
  • WP Supercache 1.5.2
  • WP Supercache 1.5.3
  • WP Supercache 1.5.4
  • WP Supercache 1.5.5
  • WP Supercache 1.5.6
  • WP Supercache 1.5.7
  • WP Supercache 1.5.7.1
  • WP Supercache 1.5.8
  • WP Supercache 1.5.9
  • WP Supercache 1.6.0
  • WP Supercache 1.6.1
  • WP Supercache 1.6.2
  • WP Supercache 1.6.3
  • WP Supercache 1.6.4
  • WP Supercache 1.6.5
  • WP Supercache 1.6.6
  • WP Supercache 1.6.7
  • WP Supercache 1.6.8
  • WP Supercache 1.6.9
  • WP Supercache 1.7.0
  • WP Supercache 1.7.1

Persistent XSS on cached page

Skrevet den af i WP Supercache

Using this vulnerability, an attacker using a carefully crafted query could insert malicious scripts to the plugin’s cached file listing page. As this page requires a valid nonce in order to be displayed, a successful exploitation would require the site’s administrator to have a look at that particular section, manually.

This vulnerability affects the following application versions:

  • WP Supercache 0.9.7
  • WP Supercache 0.9.8
  • WP Supercache 0.9.9
  • WP Supercache 0.9.9.1
  • WP Supercache 0.9.9.2
  • WP Supercache 0.9.9.3
  • WP Supercache 0.9.9.4
  • WP Supercache 0.9.9.5
  • WP Supercache 0.9.9.6
  • WP Supercache 0.9.9.7
  • WP Supercache 0.9.9.8
  • WP Supercache 0.9.9.9
  • WP Supercache 1.0
  • WP Supercache 1.1
  • WP Supercache 1.2
  • WP Supercache 1.3.1
  • WP Supercache 1.3.2
  • WP Supercache 1.4
  • WP Supercache 1.4.1
  • WP Supercache 1.4.2