CVE-2020-28707 : Vulnerability Insights and Analysis

The Stockdio Historical Chart plugin for WordPress before version 2.8.1 is vulnerable to Cross Site Scripting (XSS) due to inadequate validation of postMessage events.

Understanding CVE-2020-28707

This CVE involves a security issue in the Stockdio Historical Chart plugin for WordPress that allows for XSS attacks.

What is CVE-2020-28707?

The vulnerability in the Stockdio Historical Chart plugin for WordPress allows attackers to execute malicious JavaScript code through postMessage events, potentially leading to XSS attacks.

The Impact of CVE-2020-28707

The vulnerability can be exploited by an attacker to inject and execute malicious scripts on the affected WordPress instance, compromising user data and potentially leading to further attacks.

Technical Details of CVE-2020-28707

The technical aspects of the vulnerability are as follows:

Vulnerability Description

The issue arises from the lack of validation of the origin of postMessage events in the stockdio_chart_historical-wp.js file.
The stockdio_eventer function does not properly validate the data and data.method types before executing the received data.method.

Affected Systems and Versions

Product: Stockdio Historical Chart plugin
Vendor: N/A
Versions affected: Before 2.8.1

Exploitation Mechanism

Attackers can call window.open for the vulnerable WordPress instance and perform a postMessage(msg,'*') to execute malicious code.

Mitigation and Prevention

To address CVE-2020-28707, consider the following steps:

Immediate Steps to Take

Update the Stockdio Historical Chart plugin to version 2.8.1 or newer.
Implement Content Security Policy (CSP) headers to mitigate XSS risks.

Long-Term Security Practices

Regularly monitor and audit plugins for security vulnerabilities.
Educate users and administrators about the risks of XSS attacks and safe browsing practices.

Patching and Updates

Stay informed about security updates for WordPress plugins and apply patches promptly to prevent exploitation of known vulnerabilities.