------------------------------------------------------------------------
Stored Cross-Site Scripting in WP Canvas - Shortcodes WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Scripting vulnerability was found in the WP Canvas -
Shortcodes WordPress Plugin. This issue allows an attacker to perform a
wide variety of actions, such as stealing Administrators' session
tokens, or performing arbitrary actions on their behalf. This issue can
be exploited by authenticated users with the Contributor or higher role.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0031

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on WP Canvas - Shortcodes [2]
WordPress Plugin version 1.92.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue has been addressed in WP Canvas - Shortcodes [3] WordPress
Plugin version 2.07.

------------------------------------------------------------------------
Introduction
------------------------------------------------------------------------
The WP Canvas - Shortcodes [2] WordPress Plugin provides a number of
shortcodes that can be used in a WordPress post or page. A Cross-Site
Scripting vulnerability was found in the WP Canvas - Shortcodes
WordPress Plugin. This issue allows an attacker to perform a wide
variety of actions, such as stealing Administrators' session tokens, or
performing arbitrary actions on their behalf. This issue can be
exploited by authenticated users with the Contributor or higher role.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
This issue exists due to the lack of validation on the url attributed of
the wc_button shortcode. A Contributor or higher can create a button
with a specially crafted Javascript payload. When a (logged) on user
clicks on this button, the payload will be executed. This bypasses the
unfiltered_html privilege of WordPress, which is normally only assigned
to Editors & Administrators.

------------------------------------------------------------------------
Proof of concept
------------------------------------------------------------------------
[wc_button type="primary" url="javascript:alert(1)" title="Visit Site"
target="self" position="float"]Sample Content[/wc_button]
------------------------------------------------------------------------
References
------------------------------------------------------------------------
[1]
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_in_wp_canvas___shortcodes_wordpress_plugin.html
[2] https://wordpress.org/plugins/wc-shortcodes/
[3] https://downloads.wordpress.org/plugin/wc-shortcodes.zip