Discovered security vulnerabilities

  • Resolved nitstorm

    (@nitstorm)


    9 years, 9 months ago

    Hi,

    I’ve discovered security vulnerabilties in the CyberSyn WordPress Plugin v3.29. I had mailed you my report a few days back ( to [ email deleted ] ) on 06 June 2015, but still haven’t received a reply. Could you please confirm if you have received it or if I have to resend the mail?

    Thanks & regards,
    Nitin Venkatesh

    https://www.ads-software.com/plugins/cybersyn/

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Contributor cyberseo

    (@cyberseo)

    Your “exploit” could be applied only in case of the rogue RSS feed syndicated. This is the responsibility of the plugin owner to use only reliable feeds. I can’t block Flash, JavaScript, Java applets or any other content syndicated from the feeds, because it’s extremely useful for my customers (videos, flash games, java applets etc). So I don’t understand why you consider it as vulnerability. Please don’t post false vulnerability reports here.

    Thread Starter nitstorm

    (@nitstorm)

    Hi,

    I agree with you that it is the responsibility of the person installing a plugin to use only reliable feeds. I’ve replied to your comment via an e-mail since it deals with the specifics of the report. Please do read it and you’ll see that it is indeed a legitimate vulnerability.

    Plugin Contributor cyberseo

    (@cyberseo)

    The plugin has been removed from the repository because it can be “potentially” used by SEO “spammers”. So thank you for a good job. Hope you are happy now.

    Thread Starter nitstorm

    (@nitstorm)

    I’m very sorry to hear that. And no, I’m not happy. I have no reason to be. I was forced to escalate the situation to the WordPress team since I hadn’t heard from you in a long time or received an acknowledgement. The timeline was as follows:
    2015-06-06 – Mailed developer
    2015-06-11 – Contacted developer on the forums.
    2015-06-19 – Mailed WordPress team.

    That said, there are a lot of other online marketplaces for WordPress Plugins and Themes including Envato – https://market.envato.com/ . You could also host your svn tree at GitHub/BitBucket.

    Once again, I’m sorry to hear about your plugin.

    Plugin Contributor cyberseo

    (@cyberseo)

    Forced by whom? Why my plugin, which has 100x times less downloads than FeedWordPress, WP-o-Matic or RSS Post Importer? Why CyberSyn?

    FYI: 99% of all WordPress plugins that have a control panel are vulnerable to CSRF attack. Pick any of top 10 and it will have no protection against it. Other “vulnerabilities” of CyberSyn are related to rogue feeds only. This is a known risk but not a lack of security. The one who adds an RSS feed knows what he’s doing. So your report was about nothing. You haven’t found any real vulnerability. What exactly reply you expected to receive from me? Everything you did has no relation to the real security issues, because you haven’t found any. You’ve finelly got my plugin removed from the WordPress repository. Congrats on that!

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Discovered security vulnerabilities’ is closed to new replies.