Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The WordPress theme installer supports URLs like this: /wp-admin/theme-install.php?theme=THEME_SLUG. The route queries the WordPress.org catalog, locates the matching model, and opens a preview under wp-admin/js/theme.js. The route value is then sent to the themes API, where the same value it later put into a jQuery selector.

The slug is used for both a server-side catalog query and a CSS selector in the browser. Hoewver, they use two different parsers! Ahhh! Let's take twentytwenty"]>*>*>*/*

• The Themes API does slug canonicalization and reduces it to twentytwenty
• The CSS selector preserves the original characters, and builds the selector, with quotes, and all.

Why does this matter? We don't get XSS. However, we're on a super sensitive page! By escaping the selector collector, the selector will call trigger('click') to install the extension! So, it's a click to install a theme but it's inactive. So, no full RCE yet.

An inactive theme isn't completely inactive. It can register hooks, for instance, but nothing in the default WordPress was vulnerable, so they turned to other extensions. Mobile Repair Zone 2.5.4 registered this hook, which the theme could trigger, leading to RCE.

The selector's impact was super fascinating to me: I'd never seen a click to install something malicious from the selector. So, if you find a bug on a privileged page, think about non-traditional ways you could create impact.