A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application’s users and not the application itself while using your application as the attack’s vehicle. The XSS payload executes whenever the user opens the login page of the WordPress application.
Securin Zero-Days
CVE-2021-33851 – Stored Cross-Site Scripting in WordPress Customize Login Image
Severity:Medium
Vendor
WordPress
Affected Product
Customize Login Image
CVE
CVE-2021-33851
Securin ID
2021-CSW-11-1052
Status
Fixed
Date
December 2, 2021
Description
Proof of Concept (POC):
The following vulnerability was discovered in Customize Login Image version 3.4.
Issue: Stored Cross-Site Scripting
-
Login to the WordPress application.
Note: A virtual host (wptest.com) is used for testing the application locally.
-
Install the Customize Login Image Plugin.
-
Go to the ‘Settings’ menu and click on the ‘Customize Login Image’ drop list.
Figure 01: Customize Login Image Plugin
-
Enter the payload – <script>alert(document.cookie)</script> in the ‘Custom Logo Link’ field (cli_logo_url parameter).
Figure 02: Entering encoded XSS payload in the ‘Custom Logo Link’ field
-
Click on the ‘Save Changes’ button
-
Go to the WordPress login page at /wp-login.php .
Figure 03: Injected XSS payload is executed and displays an alert box containing the user’s cookies.
Impact
An attacker can perform the following:
-
Inject malicious code into the vulnerable variable and exploit the application through the Cross-Site Scripting vulnerability.
-
Modify the code and get the session information of other users.
-
Compromise the user machine.
Remediations
-
Perform context-sensitive encoding of entrusted input before echoing back to a browser using an encoding library throughout the application.
-
Implement input validation for special characters on all the variables are reflected in the browser and stored in the database.
-
Explicitly set the character set encoding for each page generated by the webserver.
-
Encode dynamic output elements and filter specific characters in dynamic elements.
Figure 04: The default Cross-Site Scripting mitigation setting in wp.config file to prevent XSS attacks
Timeline
Nov 30, 2021: Discovered in `Customize Login Image version 3.4 ` Product
Dec 2, 2021: Reported to WordPress team
Dec 7, 2021: Vendor fixed the issue
Dec 7, 2021: Vendor reopened the plugin for download
Dec 10, 2021: CVE assigned