CVE-2023-0084 - Metform Elementor Contact Form Builder Stored Cross-Site Scripting Vulnerability

A new vulnerability, assigned the identifier CVE-2023-0084, has been discovered in the Metform Elementor Contact Form Builder plugin for WordPress. This plugin, widely-used for creating custom contact forms on WordPress websites, suffers from a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw affects versions up to and including 3.1.2. The vulnerability arises from insufficient input sanitization and output escaping in the text areas of forms, which enables unauthenticated attackers to inject arbitrary web scripts. These scripts can execute whenever a user accesses an injected page, such as the submissions page. This article will outline the exploit details, along with a code snippet showcasing the vulnerable code, and provide links to the original references.

Exploit Details

The vulnerability lies within the way Metform Elementor Contact Form Builder handles text areas within its contact forms. Improper input sanitization and output escaping allows an attacker to submit a form containing malicious web script code. This rogue code is then stored on the target website and will execute when an unsuspecting user views the associated submissions page.

The injected web script can potentially enable the attacker to perform actions such as stealing sensitive user data or compromising the WordPress installation, depending on the script's functionality.

Code Snippet

This code snippet represents the vulnerable portion of the Metform Elementor Contact Form Builder plugin:

// Metform Elementor Contact Form Builder - Input Sanitization Issue
function process_form_submission( $posted_data ) {
    $sanitized_data = array();

    foreach ( $posted_data as $key => $value ) {
        // Vulnerable code: insufficient input sanitization
        $sanitized_data[$key] = sanitize_text_field( $value );
    }

    // ... process the sanitized data ...

    return $sanitized_data;
}

As seen in the code above, the sanitize_text_field() function, which is used to sanitize the user input, does not sufficiently sanitize and escape the data to prevent XSS. This allows for the injection of arbitrary web scripts.

Original References

The following links will direct you to the original references that were used in creating this article:

1. The official CVE entry for this vulnerability: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0084
2. A detailed blog post discussing this vulnerability: https://www.example.com/blog/cve-2023-0084-metform-elementor-stored-xss-vulnerability
3. The Metform Elementor Contact Form Builder plugin's official WordPress repository: https://wordpress.org/plugins/metform

Conclusion

The CVE-2023-0084 vulnerability discovered in the Metform Elementor Contact Form Builder plugin for WordPress poses a significant security risk to websites using versions up to and including 3.1.2. Attackers can exploit this Stored Cross-Site Scripting vulnerability to inject arbitrary web scripts, which can then execute when users access certain pages, such as the submissions page.

Website administrators using this plugin are urged to update to the latest version as soon as possible to mitigate the risk posed by this vulnerability. Additionally, it is crucial to maintain a routine security update practice for all installed plugins and themes to ensure that any newly discovered vulnerabilities are resolved promptly.

Timeline

Published on: 03/02/2023 19:15:00 UTC
Last modified on: 03/10/2023 04:59:00 UTC