Exploit-DB #34854
Description: WordPress Plugin All In One WP Security & Firewall 3.8.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-10-02
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
All In One Wordpress Firewall 3.8.3 - Persistent Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1325


Release Date:
=============
2014-09-29


Vulnerability Laboratory ID (VL-ID):
====================================
1327


Common Vulnerability Scoring System:
====================================
3.3


Product & Service Introduction:
===============================
WordPress itself is a very secure platform. However, it helps to add some extra security and firewall to your site by using a 
security plugin that enforces a lot of good security practices. The All In One WordPress Security plugin will take your website 
security to a whole new level. This plugin is designed and written by experts and is easy to use and understand. It reduces 
security risk by checking for vulnerabilities, and by implementing and enforcing the latest recommended WordPress security 
practices and techniques.

(Copy of the Vendor Homepage: https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered two persistent vulnerabilities in the official All in One Security & Firewall v3.8.3 Wordpress Plugin.


Vulnerability Disclosure Timeline:
==================================
2014-09-29: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Github
Product: All In One Security & Firewall - Wordpress Plugin 3.8.3


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Two POST inject web vulnerabilities has been discovered in the official All in One WP Security and Firewall v3.8.3 Plugin.
The vulnerability allows remote attackers to inject own malicious script codes to the application-side of the vulnerable service.

The first vulnerability is located in the 404 detection redirect url input field of the firewall detection 404 application module.
Remote attackers are able to prepare malicious requests that inject own script codes to the application-side of the vulnerable service.
The request method to inject is POST and the attack vector that exploits the issue location on the application-side (persistent).
The attacker injects own script codes to the  404 detection redirect url input field and the execution occurs in the same section 
next to the input field context that gets displayed again.

The second vulnerability is location in the file name error logs url input field of the FileSystem Components > Host System Logs module.
Remote attackers are able to prepare malicious requests that inject own script codes to the applicaation-side of the vulnerable service.
The request method to inject is POST and the attack vector that exploits the issue location on the application-side (persistent).
The attacker injects own script codes to the file name error logs url input field and the execution occurs in the same section 
next to the input field context that gets displayed again.

The security risk of the persistent POST inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.2. 
Exploitation of the application-side web vulnerability requires no privileged web-application user account but low or medium user interaction.
Successful exploitation of the vulnerability results in persistent phishing attacks, session hijacking, persistent external redirect to malicious 
sources and application-side manipulation of affected or connected module context.


Request Method(s):
				[+] POST

Vulnerable Module(s):
				[+] Firewall - Detection 404
				[+] FileSystem Components > Host System
Vulnerable Parameter(s):
				[+] 404 detection redirect url
				[+] file name error logs url

Affected Module(s):
				[+] Firewall - Detection 404
				[+] FileSystem Components > Host System


Proof of Concept (PoC):
=======================
1.1
The first POST inject web vulnerability can be exploited by remote attackers without privileged application user account and with low or 
medium user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and 
steps below to continue.

PoC: Exploit (Firewall > Detection 404 > [404 Lockout Redirect URL] )

<tr valign="top">
                <th scope="row">404 Lockout Redirect URL:</th>
<td><input size="50" name="aiowps_404_lock_redirect_url" value="http://127.0.0.1\" 
type="text"><\"<img src="\"x\"">%20%20>\"<%5C%22x%5C%22[PERSISTENT INJECTED SCRIPT CODE VIA 404 Lockout Redirect URL INPUT!]>" />
                <span class="description">A blocked visitor will be automatically redirected to this URL.</span>
                </td> 
            </tr>
        </table>
        <input type="submit" name="aiowps_save_404_detect_options" value="Save Settings" class="button-primary" />
            
        </form>
        </div></div>
        <div class="postbox">
        <h3><label for="title">404 Event Logs</label></h3>
        <div class="inside">
                        <form id="tables-filter" method="post">
            <!-- For plugins, we also need to ensure that the form posts back to our current page -->
            <input type="hidden" name="page" value="aiowpsec_firewall" />
                        <input type="hidden" name="tab" value="tab6" />            <!-- Now we can render the completed list table -->
            <input type="hidden" id="_wpnonce" name="_wpnonce" value="054474276c" /><input type="hidden" name="_wp_http_referer" 
value="/dev/wp-admin/admin.php?page=aiowpsec_firewall&tab=tab6" />	<div class="tablenav top">

		<div class="alignleft actions">