Log HTTP Requests, Version 1.3.1, Advisory

LOG HTTP REQUESTS — VERSION 1.3.1— SUMMARY

The following document describes identified vulnerabilities in the Log HTTP Requests application version 1.3.1.

Product Vendor

FACETWP, LLC

Product Description

Log HTTP Requests is a WordPress plugin that logs all WP_HTTP requests and displays them in a table listing for easy viewing. It also stores the runtime of each HTTP request. The project’s official website is https://wordpress.org/plugins/log-http-requests. The latest version of the application is 1.3.2, released on August 16, 2022.

Vulnerabilities List

One vulnerability was identified within the Log HTTP Requests plugin:

• Stored Cross-Site Scripting (XSS)

The vulnerability is described in the following sections.

Affected Version

All versions prior to and including 1.3.1

Summary of Findings

The Log HTTP Requests plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping.

Impact

The Log HTTP Requests WordPress plugin is affected by a stored XSS vulnerability that allows an attacker to gain unauthorized access to the WordPress Administrator account and carry out any action the admin was originally permitted to perform. It makes it possible for unauthenticated attackers who can trick a site’s administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Solution

Update to version 1.3.2

Vulnerabilities

Cross-Site Scripting

The cross-site scripting (XSS) vulnerability allows the execution of a JavaScript payload each time an administrator accesses the Log HTTP Requests plugin’s interface. The vulnerability could be used to push site’s administrator into performing an action that injects arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability Details

CVE ID: CVE-2022-3402

Vulnerability Type: Stored Cross-Site Scripting (XSS)

Access Vector: ☒ Remote, ☐ Local, ☐ Physical, ☐ Context dependent, ☐ Other (if other, please specify)

Impact: ☒ Code execution, ☐ Denial of service, ☒ Escalation of privileges, ☐ Information disclosure, ☐ Other (if other, please specify)

Security Risk: ☐ Critical, ☐ High, ☒ Medium, ☐ Low

Vulnerability: CWE-79

The Log HTTP Requests WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability that allows an attacker to gain unauthorized access to the WordPress Administrator account and carry out any action the admin was originally permitted to perform.

First, an administrator navigated to the search results of a malicious plugin installation interface URL with the following payload as search term:

http://localhost/wordpress1/wp-admin/plugin-install.php?s=<script>alert('bishopfox')</script>&tab=search&type=term


After the interface loaded, the payload was visible in the search bar, as shown below:

Figure 1 - Payload reflected in response without executing

Then, the user navigated to the Log HTTP Request interface located at: 

http://localhost/wordpress1/wp-admin/tools.php?page=log-http-requests

When the page loaded, the JavaScript payload was executed:

Figure 2 - Payload executed in Log HTTP Request interface

As shown above, the malicious JavaScript was executed successfully. Since the XSS vulnerability executed within the context of the admin’s session, an attacker could leverage this vulnerability to carry out any action that the admin user was originally permitted to perform.

The plugin contains the following unescaped JavaScript object property in the file assets/js/admin.js:24, which allows JavaScript code to be inserted into the DOM:

Figure 3 – Unescaped URL property being inserted into the DOM

Credits

• Etan Imanol Castro Aldrete, Consultant II, Bishop Fox ([email protected])
  

Timeline

• 08/01/2022: Initial discovery
• 08/15/2022: Contact with vendor
• 08/16/2022: Vendor acknowledged vulnerabilities
• 08/16/2022: Vendor released patched version 1.3.2
• 10/05/2022: Vulnerability publicly disclosed