search

bovas85 / nuxt-headless

Nuxt headless using WordPress REST API
https://medium.com/@moustachedesign/creating-a-website-with-nuxt-js-and-wordpress-rest-api-51cf66599cf3
MIT License
300 stars 47 forks source link

[Bug reporting] XSS vulnerabilty in wp_kses_bad_protocol in wp-includes/kses.php (CVE-2019-20041) #60

Closed seongil-wi closed 11 months ago

seongil-wi commented 3 years ago

Hi

I found a known XSS vulnerability in the recent version of nuxt-headless. In particular, the bug we report is a known bug by CVE-2019-20041.

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

Please check this line: https://github.com/bovas85/nuxt-headless/blob/197ae9f26e5c749586e3f340cf504ab95e82b1c7/wordpress/wp-includes/kses.php#L1325

Thanks!

bovas85 commented 11 months ago

fixed in https://github.com/bovas85/nuxt-headless/pull/86