716720 - Disable Comments or Remove Recaptcha Plugin - XSS issue

Status: RESOLVED FIXED

(Developer Engagement :: Mozilla Hacks, task)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Per bug 709539 the recaptcha plugin is vulnerable to XSS.

Please remove this plugin or disable comments until a replacement is available.

Proof of Concept
http://hacks.mozilla.org/2011/04/aurora/comment-page-1/?rcommentid=505568&rerror=%27%22%28%29%26%251%3Cscript%3Ealert%28localStorage.getItem%28%27foo%27%29%29%3C%2Fscript%3E97869%3C%2Fnoscript%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E12b247c29ca

Comment 1

[Raymond Forbes[:rforbes]]

turns out, this is due to an older version of wordpress.  you can upgrade to the latest plugin.

Comment 2

[Daniel Veditz [:dveditz]]

Can this bug be resolved now? The PoC from comment 0 no longer works but I don't know how to check whether the plugin was upgraded.

Comment 3

[Matt Fuller :mfuller]

This appears to be fixed now. All possible XSS characters are now being properly escaped. See: http://pastebin.mozilla.org/1864402

Comment 4

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 5

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.