exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Yoast Google Analytics 5.3.2 Cross Site Scripting

WordPress Yoast Google Analytics 5.3.2 Cross Site Scripting
Posted Mar 7, 2015
Authored by Kaustubh G. Padwad, Rohit Kumar

Yoast WordPress plugin version 5.3.2 for Google Analytics suffers from a stored cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | bcab0869ce978153b391883d5e15c089b6e6b787930736eabcb704bb265bee23

WordPress Yoast Google Analytics 5.3.2 Cross Site Scripting

Change Mirror Download
Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin

. contents:: Table Of Content

Overview

Title :Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin
Author: Kaustubh G. Padwad, Rohit Kumar.
Plugin Homepage: https://yoast.com/wordpress/plugins/google-analytics/
Severity: Medium
Version Affected: Version 5.3.2 and mostly prior to it
Version Tested : Version 5.3.2
version patched:
Description

Vulnerable Parameter

Current UA-Profile
Manually enter your UA code
Label for those links
Set path for internal links to track as outbound links:
Subdomain tracking:
Extensions of files to track as downloads:
About Vulnerability

This plugin is vulnerable to a Stored Cross Site Scripting vulnerability,This issue was exploited when administrator users with access to "Google Analytics by Yoast" Setting in wordpress above listed vulnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.

Vulnerability Class

Cross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)

Steps to Reproduce: (POC)

After installing the plugin

Goto settings --> Google Analytics by Yoast

Input this payload in "Manually enter your UA code" :- v style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x

Click on the Save Changes button and navigate your cursor to input box,you will see XSS in action
Reload the page or re navigate to page to make sure its stored ;)
Mitigation

https://github.com/Yoast/google-analytics-for-wordpress/pull/322/commits

Change Log

https://github.com/Yoast/google-analytics-for-wordpress/pull/322/commits

Disclosure

22-February-2015 Reported to developer
25-February-2015 Fixed by developer
05-March-2015 Issue Closed with team.
06-March-2015 Public Discloser

credits

Kaustubh Padwad & Rohit Kumar
Information Security Researcher
kingkaustubh@me.com & kumarrohit2255@gmail.com
@s3curityb3ast,@rkumars3c
http://breakthesec.com
https://www.linkedin.com/in/kaustubhpadwad
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close