[geeklog-devel] KSES Vulnerability in 1.4.1/1.40sr6

Mark Howard mark at the-howards.net
Sat Apr 26 11:52:49 EDT 2008

Tap .. tap..  is this thing on?  :^)

OK, so I have confirmed, this can be exploited in the KSES class included
with 1.4.1.  

I know your instructions ask that an exploit be included; however it is not
my practice to share exploits of my own creation. The advisory lists a few


Here is the quick-fix, implemented in the class as recommended in the
advisory, and it seems to work (my exploit now fails) but would appreciate
it if others could test/validate.


Note that this fix only prevents PHP code execution when kses is called
without previous entities normalization and also bypass of protocol check,
it does not deal with XSS attacks originating from exploits via CSS style
directives, eg:

(Firefox) <a style=" ;\2d\6d\6f\7a\2d\62\69\6e\64\69\6e\67:

Only a more robust/supported solution such as HTMLpurifier would represent a
best-effort fix for such a thing.  Still, perhaps this merits a
notification/fixpack containing the quick-fix to 1.4.1 users, you don't have
to say it's a complete solution.

If I get real ambitious over the weekend, I'll have a crack at modifying the
kses class to utilize the htmlpurifier wrapper, thus making it a
comprehensive drop-in fix for 1.4.1, while also permitting direct use of the
HTMLpurifier class for new code.

In case someone else has more time than I, here is the link to the wrapper


My good deed for the day.


More information about the geeklog-devel mailing list