WordPress Admin Columns Plugin Cross Site Scripting Vulnerability

Product:                   Admin Columns WordPress Plug-In
Manufacturer:              Codepress
Affected Version(s):       <5.5.2 (Pro version), <4.3.2 (Free version)
Tested Version(s):         5.5.1 (Pro version), 4.3 (Free version)
Vulnerability Type:        Cross-Site Scripting (CWE-79)
Risk Level:                High
Solution Status:           Fixed
Manufacturer Notification: 2021-05-28
Solution Date:             2021-06-18
Public Disclosure:         2021-06-21
CVE Reference:             CVE-2021-24365
Author of Advisory:        Johannes Lauinger, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Admin Columns is a WordPress plug-in, which allows creating tables of
data based on a custom columns configuration. The plug-in also allows
changing standard tables in the WordPress back end.

The manufacturer describes the product as follows (see [1]):

"Growing websites can become challenging to manage. Admin Columns helps
you to overcome this challenge. Create insightful overviews to easily
find, order, filter and update your content."

Due to missing escaping of HTML tags in columns of the type "Custom
Field", tables are vulnerable to persistent cross-site scripting
attacks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Admin Columns allows configuring individual columns for tables. Each
column has a type. The type "Custom Field" allows choosing an arbitrary
database column to display in the table. There is no escaping applied to
the contents of "Custom Field" columns.

When a "Custom Field" is used with a database column that can be
changed by attackers, JavaScript code can be injected. The code is
executed when the table is rendered. Tables can be rendered both in the
WordPress front end and back end, possibly compromising high-privileged
users.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

1. Create a custom field for WordPress users which allows storing HTML
    control characters. This can be done, e.g., with the "Advanced Custom
    Fields" plug-in [2].

2. Store "<img src=0 onerror=alert()>" in the custom field for any user.

3. Open the Admin Columns plug-in settings.

4. Choose the "Admin Columns" tab and select "Users" from the drop-down
    menu.

5. Click "Add Column", choose the type "Custom Field" and select the
    previously created custom field.

6. Open the user list in the WordPress back end. The JavaScript code
    will be executed.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Update Admin Columns to at least version 5.5.2 (Pro version) or 4.3.2
(free version).

In earlier versions, do not use the "Custom Fields / Custom Field" type
when configuring columns in the Admin Columns plug-in settings.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2021-05-27: Vulnerability discovered
2021-05-28: Vulnerability reported to manufacturer
2021-06-18: Patch released by manufacturer
2021-06-21: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Admin Columns
     https://www.admincolumns.com
[2] Product website for Advanced Custom Fields
     https://www.advancedcustomfields.com
[3] SySS Security Advisory SYSS-2021-032
 
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-032.txt
[3] SySS Responsible Disclosure Policy
     https://www.syss.de/en/responsible-disclosure-policy