Securin Discovers a XSS Vulnerability in WordPress Post Duplicator Plugin

Proof-of-Concept

1. Login to the WordPress application.
2. Install Post Duplicator Plugin.
3. Go to the ‘Tools’ menu of WordPress and click on the ‘Post Duplicator’ button.

Figure 01: Post Duplicator Settings Page

4. Enter the payload – Duplicate Post”><script>alert(document.cookie)</script> in the ‘Duplicate Title’ field (mtphr_post_duplicator_settings[title] parameter).

Figure 02: Entering  XSS payload in the  ‘Duplicate Title’ field.

5. Enter the payload – Hello World!”><script>alert(document.cookie)</script> in the ‘Duplicate Slug’ field (mtphr_post_duplicator_settings[slug] parameter).

Figure 03: Entering  XSS payload in the  ‘Duplicate Slug’ field.

1. Click on the ‘Save Changes’ button to save changes.
2. Go to the Post Duplicator Settings page at tools.php?page=mtphr_post_duplicator_settings_menu
3. Figure 04: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.

Figure 05: Duplicate the “Hello world!” post.

Figure 06: Duplicated post with XSS Payload.

Figure 07: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.

Figure 08: The default cross-site scripting mitigation setting in wp.config file to prevent cross-site scripting attacks.

Impact

1. Inject malicious code into the vulnerable variable and exploit the application through the cross-site scripting vulnerability.
2. Modify the code and get the session information of other users
3. Compromise the user machine.

Remediation

1. Perform context-sensitive encoding of entrusted input before it is echoed back to a browser using an encoding library throughout the application.
2. Implement input validation for special characters on all the variables reflected in the browser and stored in the database.
3. Explicitly set the character set encoding for each page generated by the webserver.
4. Encode dynamic output elements and filter specific characters in dynamic elements.

Timeline