Securin discovered and reported a Stored Cross-Site Scripting vulnerability in WordPress Post Duplicator Plugin that allows an authenticated attacker to inject a JavaScript payload into a trusted URL. This vulnerability has been credited with a CVE Identifier of CVE-2021-33852 and is rated as a medium severity with a CVSS v3 score of 6.1.
Post Duplicator is one of the most popular WordPress plugins, with over 200 thousand installations where users can clone posts of any type or copy them to new files for additional editing. Therefore, making this vulnerability seeks an immediate attention.
Proof-of-Concept
The following vulnerability was discovered in Post-Duplicator Plugin 2.23.
Affected Product |
Post Duplicator version 2.23 |
WordPress Version tested |
WordPress 5.8.2 |
Severity |
Medium |
CVSS Score |
6.1 |
CWE ID |
CWE-79 {Improper Neutralization of Input During Web Page Generation} |
Vulnerability Type |
Cross-Site Scripting |
Request Type |
POST |
Vulnerable URL |
http://localhost/wordpress/wp-admin/tools.php?page=mtphr_post_duplicator_settings_menu |
Vulnerable Variable/Parameters |
mtphr_post_duplicator_settings[title], mtphr_post_duplicator_settings[slug] |
Note: Here, localhost has been used for testing the application locally.
Login to the WordPress application.
Install Post Duplicator Plugin.
Go to the ‘Tools’ menu of WordPress and click on the ‘Post Duplicator’ button.
Figure 01: Post Duplicator Settings Page
4. Enter the payload – Duplicate Post”><script>alert(document.cookie)</script> in the ‘Duplicate Title’ field (mtphr_post_duplicator_settings[title] parameter).
Figure 02: Entering XSS payload in the ‘Duplicate Title’ field.
5. Enter the payload – Hello World!”><script>alert(document.cookie)</script> in the ‘Duplicate Slug’ field (mtphr_post_duplicator_settings[slug] parameter).
Figure 03: Entering XSS payload in the ‘Duplicate Slug’ field.
Click on the ‘Save Changes’ button to save changes.
Go to the Post Duplicator Settings page at tools.php?page=mtphr_post_duplicator_settings_menu
Figure 04: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.
Another use case of this vulnerability is when the post is duplicated after injecting the XSS payload in the settings page.
Figure 05: Duplicate the “Hello world!” post.
9. Once the post is duplicated, the title of the duplicated post will append the name we specified in the mtphr_post_duplicator_settings[title] parameter.
Figure 06: Duplicated post with XSS Payload.
10. Now navigate to the application root to view the posts.
Figure 07: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.
Figure 08: The default cross-site scripting mitigation setting in wp.config file to prevent cross-site scripting attacks.
Impact
An attacker can perform the following:
Inject malicious code into the vulnerable variable and exploit the application through the cross-site scripting vulnerability.
Modify the code and get the session information of other users
Compromise the user machine.
Remediation
Perform context-sensitive encoding of entrusted input before it is echoed back to a browser using an encoding library throughout the application.
Implement input validation for special characters on all the variables reflected in the browser and stored in the database.
Explicitly set the character set encoding for each page generated by the webserver.
Encode dynamic output elements and filter specific characters in dynamic elements.
Timeline
Dec 28, 2021: Discovered in `Post Duplicator Plugin – 2.23` Product
Dec 29, 2021: Reported to WordPress team
Dec 31, 2021: Vendor fixed the issue
Dec 31, 2021: Securin assigned the CVE Identifier (CVE-2021-33852)
WordPress has a massive attack surface due to the large number of active installations. At any one time, attempts to break into WordPress sites are like a continual hum in the background of all internet traffic. Therefore, we urge users to patch this vulnerability immediately.
Contribution Credits: Sriraam Natarajan