Visser Labs WordPress Plugins Multiple Vulnerabilities

by James Golovich

Last week there was a vulnerability published for the WooCommerce Store Toolkit WordPress plugin from Visser Labs. I’ll often take a look at vulnerabilities and how they are resolved. In this case I noticed that the fix only covered one part and furthermore other plugin were vulnerable to similar issues. Kudos to Michael Visser for taking all these issues in stride and getting them resolved quickly.

The following plugins all had similar vulnerabilities that have been resolved.

WooCommerce – Store Exporter

The most serious vulnerability is in this plugin. The woo_ce_admin_init() function is hooked by the ‘admin_init’ WordPress action (which happens when anything under the admin interface is loaded, not when an admin is logged in). The function checks the ‘action’ HTTP variable (GET or POST) and will perform many actions without further authorization.

The ‘export’ action does attempt to check a nonce but there is a small bug that renders it useless.

visser-exporter-export

Because of the &&, if $_POST[‘woo_ce_export’] is never passed in then the nonce will not be checked. Which allows all kinds of fun stuff to be exported.

Timeline

  • 2/8/2016 Original advisory posted
  • 2/9/2016 Sent additional information
  • 2/10/2016 Updated versions released

Sprout Invoices < 9.4 Security Vulnerabilities

by James Golovich

Sprout Invoices is a WordPress plugin for creating invoices from Sprout Apps. This is another low use plugin (1,000+ active installs on the free version as reported by the wordpress.org stats page). I believe that any issues related to an invoice/payment system need to be reported so people can get them updated before it hits them in the bank account.

Unauthenticated access to methods named init

Inside controllers/importers/Importer.php the class hooks into the ‘init’ WordPress action to provide access to various importer modules (ironically enough one of them is for the WP-Invoice package that I recently posted about). This setup allows an unauthenticated user to pass in the classname that is used to call the function ‘init’

I don’t know of any classes that come with a default WordPress install that are readily exploitable, but there could be other plugins/themes installed that could be easily exploited by being able to call their function by an arbitrary user.

sprout-importer

Unauthenticated uploading of CSV files

The CSV import module allows an unauthenticated user to upload CSV files, though it will not actually import without a valid nonce that does not appear to be leaked without having proper permissions. A malicious user could upload large files to attempt to fill up the storage space, though with the high limits available today it’s probably unlikely.

Unauthenticated access to unreleased JSON API

Dan Cameron, the developer, said that JSON API included was in development but abandoned in favor of the official WordPress REST API. Though in this release it was enabled and fully accessible to anyone without being logged in. At first glance it looks like there is some code to authenticate requests that contain ‘create-‘, but as long as that string is not included in $_REQUEST[‘si_json_api’] then it will pass along.

sprout-api

After the possible authentication function, php://input is read and passed to json_decode so any of the available API functions can be used which would allow you to create/view: clients, payments, estimates, and invoices.

Timeline

  • 1/15/2016 12:42am Initial contact form submitted
  • 1/15/2016 1:35pm Response from developer
  • 1/15/2016 5:01pm Full disclosure sent to developer
  • 1/18/2016 New version released

Beaver Builder Lite and Pro < 1.7.1 Security Issue

by James Golovich

Beaver Builder is a popular WordPress plugin that allows drag & drop editing of pages. I’m a big fan of this plugin it allows users to make some pretty great sites without a lot of work. Any plugin I’m going to use I have to do at least some minimal reading of the code to search for security issues. I discovered a few issues here, though what I did discover requires a valid WordPress user account (not just admin) to use them.

The wordpress.org page for the lite version claims there are 50,000+ active installs, I could not find any indication of how many users of the pro version there are.

Unauthorized AJAX Calls

The Beaver Builder plugin creates it’s own AJAX handler that is hooked into the ‘wp’ WordPress action.

bb-ajax

This looks solid at first glance. It requires a user to be logged in and also checks that the current_user_can() edit this post. Unfortunately as seen below, FLBuilderModel::get_post_id() allows passing the ‘post_id’ via HTTP POST data (abstracted away behind the self::get_post_data() function). A user is able to pass in HTTP POST ‘post_id=0’ and the current_user_can() function call is never run.

bb-getpostid

After a nefarious user circumvents those checks they are able to call any of the 40+ actions that Beaver Builder includes. Which would allow them to create/edit pages, manage services, list all users.

Timeline

  • 1/19/2016 3:30pm Sent request for contact information
  • 1/19/2016 10:54pm Response received
  • 1/20/2016 12:02am Security disclosure sent
  • 1/24/2016 Updated version released