BuddyPress v3.2.0 Stored XSS

            _
             | |          mark
             | |===( )   //////
             |_|   |||  | o o|
                    ||| ( c  )                  ____
                     ||| \= /                  ||   \_
                      ||||||                   ||     |
                      ||||||                ...||__/|-"
                      ||||||             __|________|__
                        |||             |______________|
                        |||             || ||      || ||
                        |||             || ||      || ||
------------------------|||-------------||-||------||-||-------


Stored/Persistent XSS through arbitrary upload of dotfile (resulting in wormable self-replicating malware):

an arbitrary file upload bug resulting in persistent/stored XSS in the form of a file uploaded on the server. This is possible due to the way BuddyPress handles Dotfiles. In BuddyPress, users have the ability to post their own statuses and they can include images within these statuses.

If you try uploading a valid image, it will be stored in a temporary folder prior to being included on your status message, here is the path for the temporary folder:

http://site.com/wp-content/uploads/bpfb/tmp/lol.jpg

Now if you use a HTTP proxy to view the request that is made while uploading a valid image, you will see that it is performed via the following API:

http://site.com/wp-admin/admin-ajax.php?action=bpfb_preview_photo&qqfile=lol.jpg

The contents of the uploaded image will be sent through a HTTP POST request, whereas the image name itself is sent via the qqfile= GET param. The POST request will look something like this:


^@^PJFIF^@^A^A^@^@^A^@^A^@^@
^BICC_PROFILE^@^A^A^@^@^B^pl
cms^D0^@^@mntrRG$Y^@^@^S ^@^
@[para^@^@^@^@^@^C^@^@^@^@^


There are whitelist filters in place, so if you try to upload an invalid file format you will see the following message:

evil.php has invalid extension. Only jpg, jpeg, png, gif are allowed.

This is where dotfiles come into play, it is possible to create a file named .jpg which will satisfy the filter (by appearing to have a valid image extension) but since there are no getimagesize(); checks or anything of the sort in place, it doesn't check to see whether what is being uploaded is actually an image (the check is being performed by the extension alone).

You can make the following request:

http://site.com/wp-admin/admin-ajax.php?action=bpfb_preview_photo&qqfile=.jpg

and for your POST data, try something like "pwned". If everything works as planned, then you will see the following JSON response:

{"note":"Success. Image uploaded."}

Since what you are uploading is not an image (but rather just a dotfile ending in jpg) then the content-type is set by default to text/html rather than image/jpg as would be expected with a regular image. Now, since the content type is set to text/html, you could send a request to the link above but with the following as your POST data:
DATA HOSTED WITH ♥ BY PASTEBIN.COM - DOWNLOAD RAW - SEE ORIGINAL
<script>alert(document.domain)</script>


and voila! You now have stored XSS. For a direct link to your uploaded HTML/JS code, you can navigate to the following URL to see your JavaScript code being triggered:
Code
http://site.com/wp-content/uploads/bpfb/tmp/.jpg

Since this is being stored as part of your status update on the 'BuddyPress' social network, and is viewable by other users, you can write a javascript payload that causes their browser to make a request to the URL listed above, with accompanying POST data containing your payload, resulting in their profile also posting an XSS payload... this means that from your single status update, everyone who views it will automatically post the same payload, and everyone who then views those statuses will also automatically post the same payload -- the end result is a worm that spreads exponentially until every single user of the social network is affected (of course, alongside this payload you could include some malware or a browser hook to infect people).