[admin] [WordPress Security] Update Now! Severe Vulnerability Impacting

As c=
an be seen, this function assembles a table of information but does not esc=
ape the values it uses. While sanitization is recommended as input is recei=
ved, escaping output, even if it is already sanitized, is a far more effect=
ive tool in preventing Cross-Site Scripting. Unfortunately, this plugin was=
not utilizing either sanitization or escaping of the stored IP value that =
could be supplied via the X-Forwarded-For: header.

To exploit this=
vulnerability, an attacker could send a login request with the following X=
-Forwarded-For header set:

X-Forwarded-For: <span =
onmouseover=3Dalert(1)>23.23.23.23</span>

This header can=
be set via many methods, such as through a browser plugin or by intercepti=
ng the login request and adding it manually. Once the plugin=E2=80=99s bloc=
king threshold is met, it will record the above code as the blocked IP and =
execute the malicious JavaScript code when an administrator visits the conf=
iguration page where the list of blocked IP addresses is displayed. This ma=
licious code is executed under the authentication of an administrator and c=
an be utilized to help facilitate a site takeover.

Cross-Site Scri=
pting Vulnerabilities are the result of missing sanitization and unescaped =
display of user input. Most commonly, we see user input that is exploitable=
to Cross-Site Scripting collected via a form. In this vulnerability, the p=
rocessed information is still provided by a user, but collected via a diffe=
rent and more unusual route which is why proper sanitization and escaping m=
ay have been missed.

Timeline

January=
26, 2023 =E2=80=93 We reached out directly to the WordPress =
Plugin Security Team as no contact information was readily available for th=
e developer of the plugin.
March 24, 2023 =E2=80=
=93 The WordPress Plugin Security Team team acknowledges receipt of our rep=
ort.
April 4, 2023 =E2=80=93 Version 1.7.2 address=
es this issue.

Conclusion

In today=E2=80=
=99s post, we covered an unauthenticated Cross-Site Scripting vulnerability=
via the X-Forwarded-For header in the Limit Login Attempts plugin. This ca=
n be leveraged by unauthenticated attackers to facilitate a site takeover b=
y injecting malicious JavaScript into the database of an affected site that=
may execute when a site administrator accesses the logging page.

Again, all&nbsp=
;=
Wordfence Premium, Wordfence Care, and Wordfence Response customers, along with those still using the free version of the plug=
in, are protected by the Wordfence firewall for any exploits targeting this=
vulnerability.

Special=
Note: We independently discovered this vulnerability in Janu=
ary while reviewing a vulnerability in another plugin. We followed our resp=
onsible disclosure process and reported it to the WordPress Plugin Security=
Team, ensured it got patched, and published it to our vulnerability databa=
se once a patch was released. After adding the vulnerability to our databas=
e, we were made aware of another unnamed security researcher who also disco=
vered this issue and publicly disclosed details about this vulnerability fi=
ve years ago without ensuring the vulnerability got patched, which does not=
follow standard practice. Regardless, we would like to make mention of thi=
s so the other researcher who also found the vulnerability receives credit.=

If you have any=
friends or colleagues who are using this plugin, please share this announc=
ement with them and encourage them to update to the latest version of Limit=
Login Attempts as soon as possible.

If you are =
a security researcher, you can responsibly disclose your finds to us and obtain a CVE ID&nb=
sp;and get your name on the Wordfence Intellig=
ence leaderboard.