Received-SPF: pass (google.com: domain of oss-security-return-30067-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Original-Subject: Wordpress Responsive theme: arbitrary HTML content injection
 (CVE-2024-2848)
Author: Hanno =?UTF-8?B?QsO2Y2s=?= <hanno@hboeck.de>
Date: Mon, 22 Apr 2024 12:52:17 +0200
From: Hanno =?UTF-8?B?QsO2Y2s=?= <hanno@hboeck.de>
To: oss-security@lists.openwall.com
Message-ID: <20240422125217.7eb0c5f0.hanno@hboeck.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: [oss-security] Wordpress Responsive theme: arbitrary HTML content injection
 (CVE-2024-2848)

A Wordpress theme called "Responsive" had a vulnerability that allowed
injecting arbitrary content into the page's footer. This is fixed in
version 5.0.3.

There are active attacks exploiting this vulnerability, redirecting
page visitors to malicious websites.
If you have to cleanup an affected installation, the attack can, as
far as I understand, only set the "footer-copyright" option stored
in the options table (usually wp_options). So you can check
the fielt with option_name=3Dfooter-copyright and remove any malicious /
spammy content.

Advisory:
https://github.com/advisories/GHSA-8vpf-jx6q-39fr

Quote:
"The Responsive theme for WordPress is vulnerable to unauthorized
modification of data due to a missing capability check on the
save_footer_text_callback function in all versions up to, and
including, 5.0.2. This makes it possible for unauthenticated attackers
to inject arbitrary HTML content into the site's footer."

Upstream changelog:
https://themes.svn.wordpress.org/responsive/5.0.3/changelog.txt
"(28/03/2024) =3D Fix - Version 5.0.3
[...]
[!] =3D Fixed =3D Fixed the vulnerability of unauthorized modification of
footer text."

The latest version 5.0.3.1 contains another possibly relevant note in
the changelog:
"(17/04/2024) =3D Fix - Version 5.0.3.1
[!] =3D Fixed =3D Enhanced Security: Strengthened the codebase to further
protect your website."

I have not verified whether this is another vulnerabiltiy or just
additional hardening.

--=20
Hanno B=C3=B6ck
https://itsec.hboeck.de/