3

I noticed that if you are an admin or editor, you are able to put in script code like this in comments (not in the page/post editor) for admin/editor roles:

<script>alert("Danger, Wil Robinson!");</script>

There doesn't seem to be much documentation on this, which is allowed by unfiltered_html (see the answers here ).

It is only enabled for admin/editor roles; other roles will ignore any scripting commands in comments. But this seems to be a security risk.

What do others think about this possible security risk that allows script commands in comments?

Added

Remember that this question is about comments, and how a malicious script in the comment can affect visitors.

Try it out on your own site. Don't log in, be a 'random' non-authenticated visitor. Put the above script command in a comment and save it. Now refresh the page, and the alert message will show up (assuming you have not disabled Javascript).

You have just proven that a malicious script in a comment will affect visitors to your site. It may not affect your site, but it will affect any visitor to your site.

Now, it might be useful for some sites to allow scripts in pages/posts. That is not the issue here. The issue is scripts in comments, which can be dangerous to the visitor.

PROOF OF CONCEPT (added)

Look at this page https://cellarweb.com/fstraptest/this-is-a-new-post/#comment-502 . Basic WP, no plugins activated, 2017 theme. Added a new post. Logged out. Opened new browser window (not tab). Loaded site as 'visitor' (no login). Looked at that post. Then commented on the post; saved it. Saw the popup. Redisplayed the post. Saw the popup.

If you go to that link, you will see "Danger Wil Robinson" popup.

Improve this question
7
  • Well depends on how safely the editor and administrators accounts are, and how many of them. I assumed it was not possible to begin with though
    – berend
    Aug 18, 2018 at 0:23
  • I can understand why admin/editors might need to put scripts in pages/posts, but can't think of a non-bad reason to allow scripts in comments. I've tested it as a 'visitor' (non-admin/editor), and it is possible to put an alert() in a a comment and have it execute on another persons system when they view that comment. That opens up a lot of possibilities for a 'bad actor'.
    – Rick Hellewell
    Aug 18, 2018 at 0:40
  • You’ve got much bigger problems than comments if there’s users you don’t trust who have the unfiltered_html capability.
    – Jacob Peattie
    Aug 18, 2018 at 1:55
  • Again, @JacobPeattie - this is not for posts or pages that are created, but for comments on posts. On a site where anyone is allowed to comment. There are those types of sites, you know. A 'bad actor' could post a comment with a malware script, and the script would execute. Try it on your own site as a non-logged-in user. Then think of an impact of a script with malware. That's the potential problem.
    – Rick Hellewell
    Aug 18, 2018 at 2:56
  • The bad actor would have to be an admin or an editor. Why are you giving that level of access to a bad actor? Scripts on comments will run for every user, but only admins or editors can post comments with scripts. If a bad actor has that level of access, they can do much worse.
    – Jacob Peattie
    Aug 18, 2018 at 3:39

1 Answer 1

Reset to default
0

It is not "security risk" per se, as an admin can just go and add whatever stupid PHP code it likes via FTP which usually can do much more damage than some JS. If an admin does stupid things then there is nothing you should do about it as after all it is his site.

Maybe worth mentioning what is the security risk with inserting random JS. Basically if you can insert JS to a page (via comments in this case), your JS can read the authentication related cookies and send them to you. Now all that is left is to "trick" the admin to get to that page and you get the cookies and therefor can access the site as admin.

OK, so not a security risk, but does sound ugly, can't we just filter out <script> for everyone? The problem is that you might want to do something less trivial as embedding a youtube video for which the sharing code might require loading some script (probably bad example if how YT works today).

The core sin with the comment form is that random users can even attempt submitting anything that contains HTML, which is not only a potential security risk, but also a bad UX for 99% of users (even the technically adapt). In an ideal world potentially non secure things would be available only from the admin side, but this particular ship had sailed ages ago.

Improve this answer
7
  • Again, the problem is not going to affect your site. It will affect your site's visitors. See added info to the question. Try it out on your own site as an unauthenticated visitor. Script code in a comment will be executed on the client side. And that doesn't seem good.
    – Rick Hellewell
    Aug 18, 2018 at 17:04
  • If things are like you describe, you should report a major security bug to core security team. As we don't hear the outcry from all over the internet I will guess that is more likely that something in how you test it is wrong
    – Mark Kaplun
    Aug 18, 2018 at 17:29
  • and I even tested it, if you comment as non admin with that string all you get is "alert(“Danger, Wil Robinson!”);" in the comment
    – Mark Kaplun
    Aug 18, 2018 at 17:33
  • See 'Proof of Concept" addition to the question.
    – Rick Hellewell
    Aug 18, 2018 at 20:41
  • if a simple alert() will pop up (as it does with my proof of concept link), imagine what a bad actor can do with some javascript malware'd commands. Would allow the bad actor to exploit the visitor's computer. Wouldn't affect the site; but allows the actor to cause the site to exploit the visitors' system.
    – Rick Hellewell
    Aug 21, 2018 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.