Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the setup wizard of Flatpress versions prior to 1.3. The vulnerability occurs because user-supplied input fields such as fpuser, email, and www are not sanitized before being included in the setup page's error messages or configuration output. This allows an attacker to inject malicious HTML or JavaScript code [1], [2].

Exploitation

To exploit this vulnerability, an attacker must trick an administrator into visiting a specially crafted URL that submits malicious input to the setup wizard. No authentication is required as the setup wizard is accessible before the blog is fully configured. The attacker can supply values like ` in the fpuser` parameter, which will then be reflected in the error message displayed on the page [1], [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information such as administrative credentials or personal data. Since the setup wizard typically runs with administrative privileges, the attacker could gain full control over the Flatpress installation [1], [2].

Mitigation

The vulnerability is fixed in Flatpress version 1.3. Users should upgrade to this version immediately. The fix is implemented in commit 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1, which adds strip_tags() to sanitize user input fields in setup.php [1]. No known workarounds exist for versions prior to 1.3.