{"id":7452,"date":"2022-01-25T18:06:42","date_gmt":"2022-01-26T01:06:42","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7452"},"modified":"2024-04-23T09:42:02","modified_gmt":"2024-04-23T16:42:02","slug":"securin-discovers-a-xss-vulnerability-in-wordpress-post-duplicator-plugin","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securin-discovers-a-xss-vulnerability-in-wordpress-post-duplicator-plugin\/","title":{"rendered":"Securin Discovers a XSS Vulnerability in WordPress Post Duplicator Plugin"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Securin discovered and reported a Stored Cross-Site Scripting vulnerability in WordPress Post Duplicator Plugin that allows an authenticated attacker to inject a JavaScript payload into a trusted URL. This vulnerability has been credited with a CVE Identifier of CVE-2021-33852 and is rated as a medium severity with a CVSS v3 score of 6.1.<\/p>

Post Duplicator is one of the most popular WordPress plugins, with over 200 thousand installations where users can clone posts of any type or copy them to new files for additional editing. Therefore, making this vulnerability seeks an immediate attention.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t

Proof-of-Concept<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The following vulnerability was discovered in Post-Duplicator Plugin 2.23.<\/p><\/colgroup>

Affected Product<\/p><\/td>

Post Duplicator version 2.23<\/p><\/td><\/tr>

WordPress Version tested<\/p><\/td>

WordPress 5.8.2<\/p><\/td><\/tr>

Vendor Homepage<\/a><\/p><\/td>

https:\/\/wordpress.org\/plugins\/post-duplicator\/<\/a><\/p><\/td><\/tr>

Severity<\/p><\/td>

Medium<\/p><\/td><\/tr>

CVSS Score<\/p><\/td>

6.1<\/p><\/td><\/tr>

CWE ID<\/p><\/td>

CWE-79 {Improper Neutralization of Input During Web Page Generation}<\/p><\/td><\/tr>

Vulnerability Type<\/p><\/td>

Cross-Site Scripting<\/p><\/td><\/tr>

Request Type<\/p><\/td>

POST<\/p><\/td><\/tr>

Vulnerable URL<\/p><\/td>

http:\/\/localhost\/wordpress\/wp-admin\/tools.php?page=mtphr_post_duplicator_settings_menu<\/a><\/p><\/td><\/tr>

Vulnerable Variable\/Parameters<\/p><\/td>

mtphr_post_duplicator_settings[title], mtphr_post_duplicator_settings[slug]<\/p><\/td><\/tr><\/tbody><\/table>

\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t

Note: <\/strong>Here, localhost has been used for testing the application locally.<\/p>

  1. Login to the WordPress application.<\/p><\/li>

  2. Install Post Duplicator Plugin.<\/p><\/li>

  3. Go to the \u2018Tools\u2019 menu of WordPress and click on the \u2018Post Duplicator\u2019 button.<\/p><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    Figure 01: <\/strong>Post Duplicator Settings Page<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    4. Enter the payload – Duplicate Post\u201d><script>alert(document.cookie)<\/script> in the \u2018Duplicate Title\u2019 field (mtphr_post_duplicator_settings[title] parameter).<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    Figure 02: <\/strong>Entering\u00a0 XSS payload in the\u00a0 \u2018Duplicate Title\u2019 field.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    5. Enter the payload – Hello World!\u201d><script>alert(document.cookie)<\/script> in the \u2018Duplicate Slug\u2019 field (mtphr_post_duplicator_settings[slug] parameter).<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    Figure 03:<\/strong> Entering\u00a0 XSS payload in the\u00a0 \u2018Duplicate Slug\u2019 field.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    1. Click on the \u2018Save Changes\u2019 button to save changes.<\/p><\/li>

    2. Go to the Post Duplicator Settings page at tools.php?page=mtphr_post_duplicator_settings_menu<\/p><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      Figure 04: <\/strong>Injected XSS payload is executed displaying an alert box with the contents of the user\u2019s cookies.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      1. Another use case of this vulnerability is when the post is duplicated after injecting the XSS payload in the settings page.<\/p><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Figure 05:<\/strong> Duplicate the \u201cHello world!\u201d post.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        9. Once the post is duplicated, the title of the duplicated post will append the name we specified in the mtphr_post_duplicator_settings[title] parameter.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Figure 06:<\/strong> Duplicated post with XSS Payload.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        10. Now navigate to the application root to view the posts.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Figure 07:<\/strong> Injected XSS payload is executed displaying an alert box with the contents of the user\u2019s cookies.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Figure 08: <\/strong>The default cross-site scripting mitigation setting in wp.config file to prevent cross-site scripting attacks.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t
        \n\t\t\t
        <\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t

        Impact<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        An attacker can perform the following:<\/p>

        • Inject malicious code into the vulnerable variable and exploit the application through the cross-site scripting vulnerability.<\/p><\/li>

        • Modify the code and get the session information of other users<\/p><\/li>

        • Compromise the user machine.<\/p><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t
          \n\t\t\t
          <\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t

          Remediation<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t

          • Perform context-sensitive encoding of entrusted input before it is echoed back to a browser using an encoding library throughout the application.<\/p><\/li>

          • Implement input validation for special characters on all the variables reflected in the browser and stored in the database.<\/p><\/li>

          • Explicitly set the character set encoding for each page generated by the webserver.<\/p><\/li>

          • Encode dynamic output elements and filter specific characters in dynamic elements.<\/p><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

            \n\t\t\t\t
            \n\t\t\t\t\t
            \n\t\t\t
            <\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t

            Timeline<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t

            Dec 28, 2021: Discovered in `Post Duplicator Plugin – 2.23` Product<\/p>

            Dec 29, 2021: Reported to WordPress team<\/p>

            Dec 31, 2021: Vendor fixed the issue<\/p>

            Dec 31, 2021: Securin assigned the CVE Identifier (CVE-2021-33852)<\/p>

            WordPress has a massive attack surface due to the large number of active installations. At any one time, attempts to break into WordPress sites are like a continual hum in the background of all internet traffic. Therefore, we urge users to patch this vulnerability immediately.<\/p>

            Contribution Credits: Sriraam Natarajan<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

            Securin discovered and reported a Stored Cross-Site Scripting vulnerability in WordPress Post Duplicator Plugin that allows an authenticated attacker to inject a JavaScript payload into a trusted URL.<\/p>\n","protected":false},"author":7,"featured_media":7453,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[82,80,109,127,154],"tags":[442,520,432,522,521],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7452"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7452"}],"version-history":[{"count":11,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7452\/revisions"}],"predecessor-version":[{"id":20607,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7452\/revisions\/20607"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/7453"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}