January 2022 Summaries

In this summary, we discussed various strategies to disable XXE (External XML Entity) processing in different contexts, including disabling DOCTYPE declarations, external entities declarations, and entity reference expansions. Disabling these features can prevent XXE vulnerabilities, which are potential security risks that allow an attacker to inject malicious content into an XML document. The approach depends on the project needs, with some solutions being more restrictive than others. For example, in Java, disabling DOCTYPE declarations or external entities declarations can be done using specific features and settings. Additionally, enabling secure processing through the Java JAXP Feature for Secure Processing (FSP) can also help prevent XXE vulnerabilities. However, not all XML processors support FSP, so additional measures may be necessary to ensure security. Overall, understanding how to configure an XML parser to prevent XXE vulnerabilities is crucial for securing applications that process XML data.

XXE (Cross-Site X-Ray Elevation) vulnerabilities are a type of security risk that can allow an attacker to access sensitive data on a web application by manipulating XML-based input, such as RSS or Atom feeds. Understanding what XXE vulnerabilities are and how they work is crucial for identifying and mitigating these risks in software development. By recognizing the signs of XXE vulnerabilities and implementing proper security measures, developers can protect their applications from exploitation and prevent sensitive data from being leaked. XXE vulnerabilities are often overlooked due to a lack of awareness or understanding of the technology involved, but with education and awareness, developers can take steps to secure their applications against these types of attacks.

The Stored Cross-Site Scripting (XSS) vulnerability in WordPress allows an attacker to inject a JavaScript payload into post slugs, which can be used for privilege escalation and hijacking admin user sessions. The vulnerability was discovered in 2018 but remained unpatched for over three years. It can be exploited by attackers with author privileges or when certain plugins, such as bbPress, are installed. The patch was released in WordPress version 5.8.3, which includes a modified function `utf8_uri_encode()` that prevents payload encoding and decoding discrepancies. Exploitation without special privileges is possible using the bbPress plugin version prior to 2.6.0. Users are strongly recommended to update their WordPress installation to the latest version to fix the vulnerability.

** In 2021, the research team at SonarSource discovered critical vulnerabilities in several popular open-source applications, including WordPress, Zimbra, LocalStack, Rocket.Chat, and SmartStoreNet. These findings were reported to vendors and resulted in over 60 CVEs being issued. The team also discovered vulnerabilities in Composer and GoCD that could have been used to launch supply chain attacks. Additionally, they presented their research at conferences such as Hacktivity Budapest and participated in Capture the Flag contests. The team was nominated for Pwnie Awards in three categories but did not win. They are already working on new vulnerability findings and will present at upcoming conferences.