Expert Posts About Blogger’s CSP Flaw

This article has been indexed from

CySecurity News – Latest Information Security and Hacking Incidents

A cybersecurity expert found a strategy to escape Content Security Policy (CSP) functions via WordPress. The hack, found by Paulos Yibelo, depends on exploiting origin method execution. The strategy incorporates JSON padding to execute a function. 

It allows the exploit of a WordPress account, however, along with cross-site scripting (XSS) exploit, that the expert doesn’t have as of now. Yibelo hasn’t tried to use the trick on live websites yet, limiting the exploits for test research websites owned by the experts. 

“I haven’t really attempted to because it requires a logged-in WordPress user or admin to visit my website, so I install the plugin and have an HTML injection – which is illegal to do,” said Yibelo. He also mentioned that they didn’t try to abuse the bug in the open on bug bounty forums. 
The exports informed WordPress about the issue three months ago, however, the latter didn’t reply. It was then that Yibelo published the findings publically on a tech blogpost. 
Attacks may happen in two situations: First, websites that don’t use WordPress primarily but have a WordPress endpoint on the same domain or subdomain. Second, a WordPress-hosted website that uses a CSP header. 
Yibelo’s blog says if an attacker finds an HTML injection vulnerability within the main domain (ex: website1.com – not

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

Read the original article: