------------------------------------------------------------------------ Persistent Cross-Site Scripting in WP Google Maps Plugin via CSRF ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A persistent Cross-Site Scripting vulnerability was found in the WP Google Maps Plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0007 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on the WP Google Maps [2] WordPress Plugin version 6.3.14. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue is resolved in WP Google Maps [3] WordPress Plugin version 6.3.15. ------------------------------------------------------------------------ Introduction ------------------------------------------------------------------------ The WP Google Maps plugin is a plugin to create a custom Google map with high quality markers containing categories, descriptions, images and links. A persistent Cross-Site Scripting vulnerability was found in the WP Google Maps Plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ The issue exists in the file wpGoogleMaps.php and is caused by the lack of output encoding on the wpgmza_store_locator_query_string request parameter. The parameter is sanitized with sanitize_text_field, which will encode characters for usage in HTML context. However, the parameter is used in JavaScript context, allowing for Cross-Site Scripting. The vulnerable code is listed below. $other_settings['store_locator_query_string'] = sanitize_text_field($_POST['wpgmza_store_locator_query_string']); if (isset($_POST['wpgmza_store_locator_restrict'])) { $other_settings['wpgmza_store_locator_restrict'] = sanitize_text_field($_POST['wpgmza_store_locator_restrict']); } [..] if (isset($map_other_settings['wpgmza_store_locator_restrict'])) { $restrict_search = $map_other_settings['wpgmza_store_locator_restrict']; } else { $restrict_search = false; } [..] { types: ['geocode'], componentRestrictions: {country: ''} }); ------------------------------------------------------------------------ Proof of Concept ------------------------------------------------------------------------ Have an authenticated admin visit a webpage with the following form: When the form is submitted (or auto-submitted), a popup box will appear, which means that the JavaScript from the parameter wpgmza_store_locator_query_string is executed in the admin's browser. The JavaScript will run every time the map (with id 1 in this case) is viewed/edited by an admin. ------------------------------------------------------------------------ References ------------------------------------------------------------------------ [1] https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_wp_google_maps_plugin_via_csrf.html [2] https://wordpress.org/plugins/wp-google-maps/ [3] https://downloads.wordpress.org/plugin/wp-google-maps.zip/