Multisite Post Duplicator 0.9.5.1 on WordPress cross-site request forgery

Summaryinfo

A vulnerability described as problematic has been identified in Multisite Post Duplicator 0.9.5.1 on WordPress. This impacts an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Multisite Post Duplicator 0.9.5.1 on WordPress (WordPress Plugin). It has been classified as problematic. Affected is an unknown code block. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on confidentiality, and integrity.

The bug was discovered 11/01/2016. The weakness was disclosed 12/09/2016 as CSRF vulnerability in Multisite Post Duplicator could allow an attacker to do almost anything an admin user can do (WordPress plugin) as confirmed mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available. The advisory points out:

Contains a CSRF vulnerability which can copy content from one site of a multisite installation to another. This could be used to add arbitrary HTML to the front-end of the site (which could be used for defacement, harvesting login credentials from authenticated users, or could be used to do virtually anything a logged-in admin user can do). This could also be used to view content not meant to be published.

A public exploit has been developed in HTML and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 38 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

<form method=\"POST\" action=\"http://localhost/wp-admin/tools.php?page=mpd\";>
  <input type=\"text\" name=\"mpd-post-status\" value=\"draft\">
  <input type=\"text\" name=\"mdp-prefix\" value=\"&lt;script&gt;alert(1)&lt;/script&gt;\">
  <input type=\"text\" name=\"action\" value=\"add_foobar\">
  <input type=\"text\" name=\"el0\" value=\"post\">
  <input type=\"text\" name=\"el1\" value=\"1\">
  <input type=\"text\" name=\"el2\" value=\"1\">
  <input type=\"text\" name=\"el3\" value=\"1\">
  <input type=\"text\" name=\"duplicate-submit\" value=\"Duplicate\">
  <input type=\"submit\">
</form>

Upgrading to version 1.1.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Multisite Post Duplicator

Version

• 0.9.5.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion