WordPress ‘XSS2Shell’ flaw allows admin takeover and remote code execution

A critical vulnerability chain dubbed XSS2Shell has been discovered in WordPress, enabling attackers to achieve administrator takeover and execute arbitrary code on affected sites. The vulnerability chain, detailed by researchers at Pwn, exploits a flaw in how the platform handles usernames on the login page, as reported by Security Affairs.

The XSS2Shell flaw begins with a specially crafted username that bypasses WordPress's initial HTML tag sanitization. This crafted input is then processed by a secondary sanitizer, wp_kses_post(), which interprets it as a valid HTML element. This technique, known as DOM clobbering, allows an attacker to inject an element with a specific ID, such as "ajaxurl", which is then accessible via the window object. WordPress's login page loads a script, user-profile.js, that automatically interacts with this injected element, triggering a chain reaction.

This chain leads to a cross-window click within an administrator's active session, enabling the attacker to generate an application password. This password can then be used to authenticate REST API requests, granting the attacker the unfiltered_html capability. With this capability, an attacker can publish a page containing malicious JavaScript, upload a plugin, and achieve remote code execution as the web server user. WordPress has released patches for versions 4.7 and later, including version 7.0.3, urging users to update immediately.

Source: Security Affairs