Document Title:
===============
Stripe Green Downloads 2.03 - Cross Site Web Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2287
Release Date:
=============
2022-10-17
Vulnerability Laboratory ID (VL-ID):
====================================
2287
Common Vulnerability Scoring System:
====================================
5.2
Vulnerability Class:
====================
Cross Site Scripting - Persistent
Current Estimated Price:
========================
500€ - 1.000€
Product & Service Introduction:
===============================
Easily configure the plugin to accept payments through Stripe with Strong Customer Authentication. Easily style payment button
with overall styling settings. Tons of options for any needs. Host files in secured folder, Media Library (WordPress plugin only)
or anywhere on your server. Send custom email notifications to buyer and administrator after successful payments. Collect statistics
of button impressions, payments and downloads for any file for any period.
(Copy of the Homepage:https://halfdata.com/green-downloads/stripe/ )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a persistent cross site vulnerability in the Stripe Green Downloads web-application and wordpress plugin.
Affected Product(s):
====================
halfdata
Product: Stripe Green Downloads - Admin Panel v1.0 (Web-Application)
Product: Stripe Green Downloads - Wordpress Plugin 2.03 (Web-Application)
Vulnerability Disclosure Timeline:
==================================
2022-10-17: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Authentication Type:
====================
Restricted Authentication (Moderator Privileges)
User Interaction:
=================
Low User Interaction
Disclosure Type:
================
Independent Security Research
Technical Details & Description:
================================
A persistent input validation web vulnerability has been discovered in the Stripe Green Downloads web-application and wordpress plugin v2.03.
The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise browser to
web-application requests from the application-side.
The persistent xss web vulnerability is located in the `Label`, `Processing label` and `Download label` input fields of the
`Green Downloads - Settings - Button` module. Attackers with local privileged to access the panel are able to inject own
malicious script code to the button that executes the content in the preview context. The request method to inject is post
and the attack vector is persistent on the application-side. The vulnerable parameters are `idcore-button-label`,
`idcore-button-label-processing` and `idcore-button-label-download`.
Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent
external redirects to malicious source and non-persistent manipulation of affected application modules.
Vulnerable Module(s):
[+] Green Downloads - Settings - Button
Vulnerable Input(s):
[+] Label
[+] Processing label
[+] Download label
Vulnerable Parameter(s):
[+] idcore-button-label
[+] idcore-button-label-processing
[+] idcore-button-label-download
Affected Module(s):
[+] Preview (/stripe/script/?page=idcore-settings)
Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerability can be exploited by remote attackers with privileged account and with low user interaction.
For security demonstration or to reproduce the cross site web vulnerability follow the provided information and steps below to continue.
Vulnerable Source: /stripe/script/?page=idcore-settings