WordPress remains one of the most popular platforms for creating and managing websites, and its extensive plugin ecosystem is a key reason for its popularity. However, with such a vast array of plugins comes the potential for security vulnerabilities. In this long read, we'll explore CVE-2022-41615, an instance of Cross-Site Scripting (XSS) vulnerability, which infects a popular WordPress plugin, the Store Locator, version 1.4.5 or earlier.

CVE-2022-41615 is a compound vulnerability involving both Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). XSS allows an attacker to inject malicious scripts into web pages viewed by other users, while CSRF tricks users into performing unintended actions on web applications to which they're authenticated. In this case, the Store Locator plugin suffers from both vulnerabilities, thereby enabling a severe weakness that hackers could take advantage of.

Exploring the Vulnerability

The vulnerable plugin, Store Locator (<= 1.4.5), is a popular WordPress tool that enables webmasters to add a location finder on their site. However, it has been discovered to contain a severe security bug that allows attackers to inject malicious code into websites utilizing the plugin.

- CVE Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41615
- NVD Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-41615

Code Snippet

As identified by researchers, the vulnerability lies in a user-controlled input field that does not sufficiently sanitize or validate user input. The problematic function code snippet can be found in the admin_save_store section of the Store Locator plugin:

function admin_save_store() {
    // Save data entered by user
    $marker_name = $_POST['marker_name'];
    $marker_lat = $_POST['marker_lat'];
    $marker_lng = $_POST['marker_lng'];
    
    //... other code ...
    
    // Insert data into the database
    $sql = "INSERT INTO " . $table_name . " 
            (marker_name, marker_lat, marker_lng)
            VALUES
            ('$marker_name','$marker_lat','$marker_lng')";

    $results = $wpdb->query( $sql );
}

As you can see, the code above directly inserts the user input, without sanitization or validation, into the SQL query.

Exploit Details

An attacker can use both XSS and CSRF to exploit this vulnerability by crafting a malicious link that initiates a CSRF request. The attacker then tricks the logged-in WordPress administrator into clicking the link, which in turn injects and executes malicious code through the XSS vulnerability.

https://vulnerablewordpress.com/wp-admin/admin-post.php?action=admin_save_store&marker_name=<script>alert('XSS');</script>&marker_lat=13.415&marker_lng=52.5219

When a logged-in administrator clicks on this link, the CSRF vulnerability of the plugin is exploited by adding a new store location with the provided name, latitude, and longitude. The XSS vulnerability then allows the injected JavaScript code to execute within the browser, triggering an alert with the message 'XSS'. In a real attack, this could be replaced by much more harmful code, potentially stealing user credentials or causing more damage to the website.

Recommendations

To prevent the exploitation of the CVE-2022-41615 vulnerability, WordPress administrators should immediately update the Store Locator plugin to a patched version or consider using alternative plugins that do not suffer from this critical XSS and CSRF vulnerability. Furthermore, administrators should stay up-to-date with the latest security news and promptly update their plugins and themes to maintain the security of their websites.

Conclusion

CVE-2022-41615 is a stark reminder that every plugin in the WordPress ecosystem may contain vulnerabilities that attackers can exploit. Thus, it is essential for webmasters to stay vigilant about the security of their websites. By understanding how this specific XSS and CSRF vulnerability works and the potential harm it can cause, you can better protect your site from future threats.

Timeline

Published on: 11/18/2022 23:15:00 UTC
Last modified on: 11/23/2022 19:44:00 UTC