08c1a4df45
9 changes to exploits/shellcodes Google Chrome V8 JIT - 'LoadElimination::ReduceTransitionElementsKind' Type Confusion DVD X Player Standard 5.5.3.9 - Buffer Overflow iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting Wordpress Plugin Activity Log 2.4.0 - Stored Cross Site Scripting WUZHI CMS 4.1.0 - ‘Add Admin Account’ Cross-Site Request Forgery WUZHI CMS 4.1.0 - ‘Add User Account’ Cross-Site Request Forgery Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control WordPress File Upload Plugin 4.3.2 - Stored Cross Site Scripting WordPress Plugin WordPress File Upload 4.3.3 - Stored XSS
44 lines
No EOL
2.4 KiB
Text
44 lines
No EOL
2.4 KiB
Text
# Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting (XSS)
|
||
# Date: 25-02-2018
|
||
# Exploit Author : Stefan Broeder
|
||
# Vendor Homepage: https://pojo.me
|
||
# Software Link: https://wordpress.org/plugins/aryo-activity-log/
|
||
# Version: 2.4.0
|
||
# CVE : CVE-2018-8729
|
||
# Category : webapps
|
||
|
||
Description
|
||
===========
|
||
Activity Log is a WordPress plugin which tracks site activity. It has more than 70.000 active installations. Version 2.4.0 (and possibly the previous ones) are affected by several Stored XSS vulnerabilities.
|
||
|
||
Vulnerable part of code
|
||
=======================
|
||
Storing the payload:
|
||
File: aryo-activity-log/hooks/class-aal-hook-attachment.php:14. The log entry that is stored contains the result of get_the_title($post->ID), which can include HTML and is not sanitized by WordPress.
|
||
File: aryo-activity-log/hooks/class-aal-hook-comments.php:14. The log entry that is stored contains the result of get_the_title($comment->comment_post_ID), which can include HTML and is not sanitized by WordPress.
|
||
File: aryo-activity-log/hooks/class-aal-hook-posts.php:7. The log entry that is stored contains the result of $title = get_the_title($post), which can include HTML and is not sanitized by WordPress.
|
||
|
||
Displaying the payload:
|
||
File: aryo-activity-log/classes/class-aal-activity-log-list-table.php:209. $item->object_name is displayed without sanitization and can contain HTML tags.
|
||
|
||
Impact
|
||
======
|
||
Arbitrary JavaScript code can be run on browser side if a user is able to create a post or upload an attachment.
|
||
|
||
Exploitation
|
||
============
|
||
To successfully exploit this vulnerability, an attacker would have to perform any of the following:
|
||
- Create/edit/draft/publish/trash/untrash a post with JavaScript in the title
|
||
- Create/edit/trash/untrash/mark_as_spam/unmark_as_spam a comment on a post with JavaScript in the title
|
||
- Add/edit/delete an attachment with JavaScript in the attachment title
|
||
|
||
Regular website visitors will not have the capability to do any of these, however, possible threat actors might include:
|
||
- A user with the role of ‘editor’ within WordPress (non-admins which are able to create content)
|
||
- A rogue administrator among multiple administrators
|
||
- A compromised plugin
|
||
|
||
If the payload has been injected, then it will be executed once the Activity Log is viewed. This can possibly lead to stealing of CSRF nonces and creation of new (administrator) users on the WordPress instance.
|
||
|
||
Solution
|
||
========
|
||
Update to 2.4.1 |