WordPress reflected XSS

WordPress is a blog platform developed using the PHP language. You can set up your own blog on servers that support PHP and MySQL databases. WordPress can also be used as a Content Management System (CMS. Recently, security researchers outside China announced that WordPress uses insecure third-party components in some functions, resulting in XSS vulnerabilities. When attackers trick administrators into clicking, they can directly GETSHELL the attack.
Detailed description:

Original article: https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
 
Perform reverse Compilation and Analysis on wp-uplodes/js/swfupload/swfupload.swf, so that swfupload.swf can pass in ExternalInterface. the second parameter of call is encoded securely, but the function name is ExternalInterface. the first parameter of call is not encoded securely. Some Characters in the function name can be controlled at www.2cto.com, resulting in xss vulnerability.
 
This. movieName = root. loaderInfo. parameters. movieName;
...
This. flashReady_Callback = "SWFUpload. instances [\" "+ this. movieName +" \ "]. flashReady ";
...
If (ExternalCall. Bool (this. testExternalInterface_Callback )){
ExternalCall. Simple (this. flashReady_Callback );
This. hasCalledFlashReady = true;
}
 
========================
Class ExternalCall extends Object {
...
Public static function Simple (param1: String): void
{
ExternalInterface. call (param1 );
Return;
}
Proof of vulnerability:

Http://www.80sec.com/wp-includes/js/swfupload/swfupload.swf? MovieName = "])} catch (e) {if (! Window. x) {window. x = 1; alert (/xss /)}}//
Solution:

Delete swfupload.swf temporarily and wait for official updates.