CVE-2019-9787 PoC — WordPress 跨站请求伪造漏洞

Source

Associated Vulnerability

Readme

# mitigation-cve-2019-9787
# POC 
1. simply xss :<script>alert('xss');</script>
2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io
3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io


# mitigation
1. fix the logic flaw in the sanitization process for administrators. 
add the two line in /wp-admin/includes/ajax-actions.php and /wp-includes/comment.php(detail in the report)
remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
add_filter( 'pre_comment_content', 'wp_filter_kses' );
2. http-only
For session cookies managed by PHP, the flag is set either permanently in php.ini PHP manual on HttpOnly through the parameter:

session.cookie_httponly = True

3. hash-based defence
   CSRF validation token has not been implemented in WordPress because if done, it would hinder the trackbacks and pingbacks features of WordPress. Server cannot        distinguish illegal CSRF request from legal PINGBACK/TRACEBACK request, wordpress automatically accept comment without correct CSRF-token as a PINFBACK and TRACEBACK request and filter that comment with a white-list filter.

   To defence this CSRF vulnerability, we add a new field in the form called hashnonce to verify that the comment is send by administrator. The admin sign a signature on the value of comment field with their cookie.

   The signature of the value of comment field used md5 to generated the hash value(see graph ).

   When admin tries to adopt PINFBACK and TRACEBACK and the _wp_unfiltered_html can not be provided, we use the wp_verify_hashNonce. If the validation fails, an error will be reported. Even if the validation is successful, the logic error has been corrected and "wp_filter_kses" will be used to filter comments.

   Code modified:
   1. comment-template: js script calculate and add hashNonce script;
   2. pluggable: PHP script added verify hashNonce script.
   3. comment: PHP script changed the request process logic.

   the third method is change from https://github.com/sijiahi/Wordpress_cve-2019-9787_defense

File Snapshot

 [4.0K]  /data/pocs/0ec5d24550f4dbc6639da2acaf951ec7f4944084
└── [2.1K]  README.md

0 directories, 1 file

Remarks