One of the ways we help to improve the security of WordPress plugins, not just for the customers of our service, but for everyone using them, is our proactive monitoring of changes made to plugins in the Plugin Directory to try to catch serious vulnerabilities. Due to recent improvements to that we caught a cross-site request forgery (CSRF)/PHP object injection vulnerability in WP Google Map Plugin, which has 100,000+ installs.

Yesterday when discussing a vulnerability we accidentally ran across we noted that the complicated nature of the code might have help to explain how the security vulnerability came about. That seems like it could also apply to this plugin as well as the code leading to the vulnerability seems overly complicated and critical security code is more complicated than needs to be, while not functioning properly.

When accessing the page /wp-admin/admin.php?page=wpgmp_form_map, which is normally only accessible to Administrators, with the POST input “operation” set to “save the function save() in the file runs /modules/map/model.map.php. In that function is this code to check if a valid nonce has been provided to prevent cross-site request forgery (CSRF):

103
104
105
106

if ( isset( $_REQUEST['_wpnonce'] ) )
$nonce = sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) );
if ( isset( $nonce ) && ! wp_verify_nonce( $nonce, 'wpgmp-nonce' ) )
die( 'You are not allowed to save changes!' );

There isn’t a need to sanitize the nonce value being checked as is done there. The bigger issue is that the function only properly checks for a valid nonce if you send along a nonce with the request. So if you send along an invalid nonce the code will properly stop the rest of the code in the function from running, but if you don’t send one it fails to stop execution despite a valid once not being provided.

Among the code that then runs is the following:

138
139
140
141
142
143
144
145
146

if( isset( $_POST['wpgmp_import_code'] ) && $_POST['wpgmp_import_code'] !='' ) {
	$import_code = wp_unslash( $_POST['wpgmp_import_code'] );
	if( trim($import_code) !='' ) {
		$map_settings = unserialize(base64_decode($import_code));
		if( is_object( $map_settings ) ) {
			$_POST = (array) $map_settings;
		}
	}
}

That code will pass the base64 decoded value of the POST input “wpgmp_import_code” through the unserialize() function, which permits PHP object injection to occur.

WordPress Causes Full Disclosure

Due to the moderators of the WordPress Support Forum’s continued inappropriate behavior we are full disclosing vulnerabilities in protest until WordPress gets that situation cleaned up, so we are releasing this post and then leaving a message about that for the developer through the WordPress Support Forum. You can notify the developer of this issue on the forum as well. Hopefully the moderators will finally see the light and clean up their act soon, so these full disclosures will no longer be needed (we hope they end soon). You would think they would have already done that, but considering that they believe that having plugins, which have millions installs, remain in the Plugin Directory despite them knowing they are vulnerable is “appropriate action”, something is very amiss with them (which is even more reason the moderation needs to be cleaned up).

Update: To clear up the confusion where developers claim we hadn’t tried to notify them through the Support Forum (while at the same time moderators are complaining about us doing just that), here is the message we left for this vulnerability:

Is It Fixed?

If you are reading this post down the road the best way to find out if this vulnerability or other WordPress plugin vulnerabilities in plugins you use have been fixed is to sign up for our service, since what we uniquely do when it comes to that type of data is to test to see if vulnerabilities have really been fixed. Relying on the developer’s information, can lead you astray, as we often find that they believe they have fixed vulnerabilities, but have failed to do that.

Proof of Concept

With our plugin for testing for PHP object injection installed and activated, the following proof of concept will cause the message “PHP object injection has occurred.” be shown, when logged in to WordPress as an Administrator.

Make sure to replace “[path to WordPress]” with the location of WordPress.

<html>
<body>
<form action="http://[path to WordPress]/wp-admin/admin.php?page=wpgmp_form_map" method="POST">
<input type="hidden" name="operation" value="save" />
<input type="hidden" name="wpgmp_import_code" value='TzoyMDoicGhwX29iamVjdF9pbmplY3Rpb24iOjA6e30=' />
<input type="submit" value="Submit" />
</form>
</body>
</html>

Concerned About The Security of the Plugins You Use?