Back to all zero days
Stored Cross-Site Scripting in WordPress [Post Duplicator Plugin - 2.23]
Dec 2, 2021
Proof of concept: (POC)
The following vulnerability was discovered in Post-Duplicator Plugin 2.23.
Issue: Stored Cross-Site Scripting
Note: Here, localhost has been used for testing the application locally.
Login to the WordPress application.
Install Post Duplicator Plugin.
Go to the ‘Tools’ menu of WordPress and click on the ‘Post Duplicator’ button.
Figure 01: Post Duplicator Settings Page
Enter the payload - Duplicate Post”><script>alert(document.cookie)</script> in the ‘Duplicate Title’ field (mtphr_post_duplicator_settings[title] parameter).
Figure 02: Entering XSS payload in the ‘Duplicate Title’ field
Enter the payload - Hello World!”><script>alert(document.cookie)</script> in the ‘Duplicate Slug’ field (mtphr_post_duplicator_settings[slug] parameter).
Figure 03: Entering XSS payload in the ‘Duplicate Slug’ field
Click on the ‘Save Changes’ button to save changes.
Go to the Post Duplicator Settings page at tools.php?page=mtphr_post_duplicator_settings_menu
Figure 04: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.
Another use case of this vulnerability is when the post is duplicated after injecting the XSS payload in the settings page.
Figure 05: Duplicate the “Hello world!” post
Once the post is duplicated, the title of the duplicated post will append the name we specified in the mtphr_post_duplicator_settings[title] parameter.
Figure 06: Duplicated post with XSS Payload
Now navigate to the application root to view the posts.
Figure 07: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.
Figure 08: The default cross-site scripting mitigation setting in wp.config file to prevent cross-site scripting attacks
An attacker can perform the following:
Inject malicious code into the vulnerable variable and exploit the application through the cross-site scripting vulnerability.
Modify the code and get the session information of other users
Compromise the user machine.
Perform context-sensitive encoding of entrusted input before it is echoed back to a browser using an encoding library throughout the application.
Implement input validation for special characters on all the variables reflected in the browser and stored in the database.
Explicitly set the character set encoding for each page generated by the webserver.
Encode dynamic output elements and filter specific characters in dynamic elements.
Dec 28, 2021: Discovered in `Post Duplicator Plugin - 2.23` Product
Dec 29, 2021: Reported to WordPress team
Dec 31, 2021: Vendor fixed the issue
Dec 31, 2021: CSW assigned the CVE Identifier (CVE-2021-33852)
Cyber Security Works Pvt. Ltd.
- Affected VendorWordPress
- Bug NameStored Cross-Site Scripting
- CVE NumberCVE-2021-33852
- CWE IDCWE-79
- CSW ID2021-CSW-12-1053
- CVSSv3 Score6.1
- Affected VersionPlugin - 2.23
- Affected ProductPost-Duplicator Plugin 2.23