WordPress Astra Theme Vulnerability Affects +1 Million Sites

One of many World’s hottest WordPress themes quietly patched a safety vulnerability over the weekend that safety researchers say seems to have patch a saved XSS vulnerability.

The official Astra changelog supplied this rationalization of the safety launch:

“Enhanced Safety: Our codebase has been strengthened to additional defend your web site.”

Their changelog, which paperwork adjustments to the code that’s included in each replace, affords no details about what the vulnerability was or the severity of it.  Theme customers thus can’t make an knowledgeable resolution as as to if to replace their theme as quickly as potential or to conduct checks first earlier than updating to insure that the up to date theme is appropriate with different plugins in use.

SEJ reached out to the Patchstack WordPress safety firm who verified that Astra could have patched a cross-site scripting vulnerability.

Cross-Website Scripting Vulnerability (XSS)

A cross-site scripting vulnerability is among the commonest sort of vulnerabilities discovered on WordPress that usually arises inside third get together plugins and themes. It’s a vulnerability that happens when there’s a strategy to enter knowledge however the plugin or theme doesn’t sufficiently filter what’s being enter or output which may subsequently permit an attacker to add a malicious payload.

An instance could be a script that can be utilized to focus on a web site customer’s browser to entry that their session cookie and different delicate info which in flip can lead to undesirable web site entry.

This specific vulnerability known as a saved XSS. A saved XSS is especially regarding as a result of it includes instantly importing the payload to the web site server the place it’s saved and stays.

The non-profit Open Worldwide Utility Safety Challenge (OWASP) web site affords the next description of a stored XSS vulnerability:

“Saved assaults are these the place the injected script is completely saved on the goal servers, comparable to in a database, in a message discussion board, customer log, remark area, and so on. The sufferer then retrieves the malicious script from the server when it requests the saved info. Saved XSS can also be typically known as Persistent or Sort-II XSS.”

Escaping Output, Enter Sanitization and Validation

Untrusted knowledge within the context of XSS vulnerabilities in WordPress plugins and themes can occur wherever a consumer can enter knowledge, whether or not it’s by a contact kind, meta knowledge, feedback or wherever else that knowledge might be enter.

This course of known as Sanitization and Validation, two methods of securing a WordPress web site.

Sanitization might be mentioned to be a course of that filters enter knowledge. Validation is the method of checking what’s enter to find out if it’s precisely what’s anticipated, like textual content as an alternative of code.

One other perform that’s essential is a course of referred to as escaping output, which is the method of checking and eradicating undesirable knowledge earlier than it reaches a browser.  Escaping makes certain that something that’s output, comparable to consumer enter or database content material, is secure to show within the browser.

WordPress safety firm Patchstack recognized adjustments to features that escape knowledge which in flip provides clues as to what the vulnerability is and the way it was fastened.

Brainstorm Drive Astra WordPress Theme

Astra is among the world’s hottest WordPress theme. It’s a free theme that’s comparatively  light-weight, simple to make use of and leads to skilled wanting web sites. It even has Schema.org structured knowledge built-in inside it.

Patchstack Evaluate Of Plugin

SEJ contacted Patchstack who promptly reviewed the modified recordsdata and recognized a potential theme safety concern in three WordPress features. WordPress features are code that may change how WordPress options behave comparable to altering how lengthy an excerpt is. Capabilities can add customizations and introduce new options to a theme.

Patchstack defined their findings:

“I downloaded model 4.6.9 and 4.6.8 (free model) from the WordPress.org repository and checked the variations.

Evidently a number of features have had a change made to them to flee the return worth from the WordPress perform get_the_author.

This perform prints the “display_name” property of a consumer, which may comprise one thing malicious to finish up with a cross-site scripting vulnerability if printed instantly with out utilizing any output escaping perform.

The next features have had this variation made to them:

astra_archive_page_info
astra_post_author_name
astra_post_author

If, for instance, a contributor wrote a put up and this contributor adjustments their show title to comprise a malicious payload, this malicious payload will likely be executed when a customer visits that web page with their malicious show title.”

Patchstack Publishes An Advisory

It’s unknown whether or not a 3rd get together safety researcher found the vulnerability or if Brainstorm, the makers of the Astra theme, found it themselves and patched it.

The official Patchstack advisory supplied this info:

“An unknown particular person found and reported this Cross Website Scripting (XSS) vulnerability in WordPress Astra Theme. This might permit a malicious actor to inject malicious scripts, comparable to redirects, commercials, and different HTML payloads into your web site which will likely be executed when visitors go to your web site. This vulnerability has been fastened in model 4.6.9.”

Patchstack assessed the vulnerability as a medium menace and assigned it a rating of 6.5 on a scale of 1 – 10.