WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The wordpress development team reports :

- Blocking server-side request forgery attacks, which could potentially enable an attacker to gain access to a site

- Disallow contributors from improperly publishing posts

- An update to the SWFUpload external library to fix cross-site scripting vulnerabilities

- Prevention of a denial of service attack, affecting sites using password-protected posts

- An update to an external TinyMCE library to fix a cross-site scripting vulnerability

- Multiple fixes for cross-site scripting

- Avoid disclosing a full file path when a upload fails

WordPress 3.5.2 is now available. This is the second maintenance release of 3.5, fixing 12 bugs. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. The WordPress security team resolved seven security issues, and this release also contains some additional security hardening.

The security fixes included :

  - Blocking server-side request forgery attacks, which     could potentially enable an attacker to gain access to a     site.

    - Disallow contributors from improperly publishing       posts, reported by Konstantin Kovshenin, or       reassigning the post's authorship, reported by Luke       Bryan.

    - An update to the SWFUpload external library to fix       cross-site scripting vulnerabilities. Reported by mala       and Szymon Gruszecki. (Developers: More on SWFUpload       here.)

    - Prevention of a denial of service attack, affecting       sites using password-protected posts.

    - An update to an external TinyMCE library to fix a       cross-site scripting vulnerability. Reported by Wan       Ikram.

    - Multiple fixes for cross-site scripting. Reported by       Andrea Santese and Rodrigo.

    - Avoid disclosing a full file path when a upload fails.
      Reported by Jakub Galczyk.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated wordpress package fixes security vulnerabilities :

A denial of service flaw was found in the way Wordpress, a blog tool and publishing platform, performed hash computation when checking password for password protected blog posts. A remote attacker could provide a specially- crafted input that, when processed by the password checking mechanism of Wordpress would lead to excessive CPU consumption (CVE-2013-2173).

Inadequate SSRF protection for HTTP requests where the user can provide a URL can allow for attacks against the intranet and other sites. This is a continuation of work related to CVE-2013-0235, which was specific to SSRF in pingback requests and was fixed in 3.5.1 (CVE-2013-2199).

Inadequate checking of a user's capabilities could allow them to publish posts when their user role should not allow for it; and to assign posts to other authors (CVE-2013-2200).

Inadequate escaping allowed an administrator to trigger a cross-site scripting vulnerability through the uploading of media files and plugins (CVE-2013-2201).

The processing of an oEmbed response is vulnerable to an XXE (CVE-2013-2202).

If the uploads directory is not writable, error message data returned via XHR will include a full path to the directory (CVE-2013-2203).

Content Spoofing in the MoxieCode (TinyMCE) MoxiePlayer project (CVE-2013-2204).

Cross-domain XSS in SWFUpload (CVE-2013-2205).

Several vulnerabilities were identified in WordPress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the wordpress package to the latest upstream version instead of backporting the patches.

This means extra care should be taken when upgrading, especially when using third-party plugins or themes, since compatibility may have been impacted along the way. We recommend that users check their install before doing the upgrade.

  - CVE-2013-2173     A denial of service was found in the way WordPress     performs hash computation when checking password for     protected posts. An attacker supplying carefully crafted     input as a password could make the platform use     excessive CPU usage.

  - CVE-2013-2199     Multiple server-side requests forgery (SSRF)     vulnerabilities were found in the HTTP API. This is     related to CVE-2013-0235, which was specific to SSRF in     pingback requests and was fixed in 3.5.1.

  - CVE-2013-2200     Inadequate checking of a user's capabilities could lead     to a privilege escalation, enabling them to publish     posts when their user role should not allow for it and     to assign posts to other authors.

  - CVE-2013-2201     Multiple cross-side scripting (XSS) vulnerabilities due     to badly escaped input were found in the media files and     plugins upload forms.

  - CVE-2013-2202     XML External Entity Injection (XXE) vulnerability via     oEmbed responses.

  - CVE-2013-2203     A Full path disclosure (FPD) was found in the file     upload mechanism. If the upload directory is not     writable, the error message returned includes the full     directory path.

  - CVE-2013-2204     Content spoofing via Flash applet in the embedded     tinyMCE media plugin.

  - CVE-2013-2205     Cross-domain XSS in the embedded SWFupload uploader.

According to its version number, the WordPress install hosted on the remote web server is affected by multiple vulnerabilities :

  - The application contains a denial of service attack,     affecting sites using password-protected posts.
    (CVE-2013-2173)

  - The application is affected by a server-side request     forgery vulnerability. This vulnerability can be used     to gain access to a site. (CVE-2013-2199)

  - A privilege escalation vulnerability exists that allows     contributors to publish posts and users to reassign     authorship. (CVE-2013-2200)

  - A cross-site scripting vulnerability exists related to     uploading media. (CVE-2013-2201)

  - A XML External Entity Injection (XXE) vulnerability     exists in 'oEmbed'. (CVE-2013-2202)

  - A vulnerability exists disclosing a full file path     related to file upload. (CVE-2013-2203)

  - A cross-site scripting vulnerability exists related     to 'TinyMCE' library. (CVE-2013-2204)

  - The application is affected by a cross-site scripting     vulnerability in the 'SWFUpload' library.
    (CVE-2013-2205)

  - Cross-site scripting vulnerabilities exist in the     'post.php' script relating to the 'excerpt' and     'content' parameters.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of WordPress earlier than 3.5.2 are potentially affected by the following vulnerabilities :

 - The application contains a denial of service attack affecting sites using password-protected posts.(CVE-2013-2173)
 - The application is affected by a server-side request forgery vulnerability. This vulnerability can be used to gain access to a site. (CVE-2013-2199)
 - A privilege escalation vulnerability exists that allows contributors to publish posts and users to reassign authorship. (CVE-2013-2200)
 - A cross-site scripting vulnerability exists related to uploading media. (CVE-2013-2201)
 - A XML External Entity Injection (XXE) vulnerability exists in 'oEmbed'. (CVE-2013-2202)
 - A vulnerability exists disclosing a full file path related to file upload. (CVE-2013-2203)
 - A cross-site scripting vulnerability exists related to 'TinyMCE' library. (CVE-2013-2204)
 - The application is affected by a cross-site scripting vulnerability in the 'SWFUpload' library. (CVE-2013-2205)
 - Cross-site scripting vulnerabilities exist in the 'post.php' script relating to the 'excerpt' and 'content' parameters.

ID	Name	Product	Family	Severity
69087	FreeBSD : wordpress -- multiple vulnerabilities (049332d2-f6e1-11e2-82f3-000c29ee3065)	Nessus	FreeBSD Local Security Checks	medium
67317	Fedora 17 : wordpress-3.5.2-1.fc17 (2013-11649)	Nessus	Fedora Local Security Checks	medium
67315	Fedora 18 : wordpress-3.5.2-1.fc18 (2013-11630)	Nessus	Fedora Local Security Checks	medium
67314	Fedora 19 : wordpress-3.5.2-1.fc19 (2013-11590)	Nessus	Fedora Local Security Checks	medium
67134	Mandriva Linux Security Advisory : wordpress (MDVSA-2013:189)	Nessus	Mandriva Local Security Checks	medium
67131	Debian DSA-2718-1 : wordpress - several vulnerabilities	Nessus	Debian Local Security Checks	medium
67021	WordPress < 3.5.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium
6883	WordPress < 3.5.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	low

Detections

Analytics

CVE-2013-2202

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

low