Reflected Cross-Site Scripting (XSS) Vulnerability in Numerous Plugins by BestWebSoft

Last Thursday we notified the developer of the plugin Contact Form by BestWebSoft of the results of our security review of their plugin (the plugin was chosen by our customer to receive a review from us). One of the issues we noticed was reflected cross-site scripting (XSS) vulnerability, which we also found existed in 40 other of their plugins due to the code that caused the vulnerability being shared among the plugins.

While preparing the data on the vulnerability in those plugins to add to our data set once we disclosed the vulnerability we noticed that the same issue had been fixed in 12 other plugins by the developer as of the day we notified them, so we figured that we were not the only ones that had noticed this vulnerability. Today a company named DefenseCode put out a report on the vulnerabilities (PDF), in which they state they notified the developer of the vulnerability on March 24. In their report the response from the developer states they were already aware of the issue before even then:

We have already known about this vulnerability and some plugins have already been fixed. We will fix the rest of the plugins in their future updates.

Looking at the dates that some of the plugins have the vulnerability fixed confirms that they were aware of it before then. While the vulnerability is rather minor (it is unlikely to be targeted by hackers), leaving plugins used on hundreds of thousands of websites vulnerable for at least a month is concerning.

Since the information is out there it doesn’t make sense to hold back our independent disclosure, as we continue to do with the rest of the results of our review in line with our current vulnerability disclosure policy. Under the current policy we don’t disclose unfixed vulnerabilities for 30 days when the developer responds to our contact and the vulnerability is not already being exploited or obvious.

Here is how the issue exists in version 4.0.5 of Contact Form by BestWebSoft. In the file /bws_menu/bws_menu.php the value of the GET input “category” is set as the value of the variable $plugin_category without being sanitized:

40	$plugin_category = isset( $_GET['category'] ) ? $_GET['category'] : 'all';

The on line 447-449 the value of the variable is echo’d without being escaped:

<li><a <?php if ( ! isset( $_GET['sub'] ) ) echo 'class="current" '; ?>href="<?php echo $current_page; if ( 'all' != $plugin_category ) echo '&amp;category=' . $plugin_category; ?>"><?php _e( 'All', 'bestwebsoft' ); ?></a></li> |
<li><a <?php if ( isset( $_GET['sub'] ) && 'installed' == $_GET['sub'] ) echo 'class="current" '; ?>href="<?php echo $current_page; ?>&amp;sub=installed<?php if ( 'all' != $plugin_category ) echo '&amp;category=' . $plugin_category; ?>"><?php _e( 'Installed', 'bestwebsoft' ); ?></a></li> |
<li><a <?php if ( isset( $_GET['sub'] ) && 'not_installed' == $_GET['sub'] ) echo 'class="current" '; ?>href="<?php echo $current_page; ?>&amp;sub=not_installed<?php if ( 'all' != $plugin_category ) echo '&amp;category=' . $plugin_category; ?>"><?php _e( 'Not Installed', 'bestwebsoft' ); ?></a></li>

Additional Impacted Plugins

The easiest way to know if you are impacted by this is to sign up for our service as our customers will be emailed if they are using vulnerable versions of any of the impacted plugins and also be able to check from inside WordPress if any of their plugins are vulnerable (or contained vulnerabilities in other versions). Currently, when you sign up you can try the service for free for the first month.

As of last Thursday we found the vulnerability was still in the following additional plugins (one was subsequently fixed):

It was previously in the following plugins:

Proof of Concept

The following proof of concept will cause any available cookies to be shown in alert box. Major web browsers other than Firefox provide XSS filtering, so this proof of concept will not work in those web browsers.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-admin/admin.php?page=bws_panel&category="><script>alert(document.cookie);</script>

Timeline

April 6, 2017 – Developer notified.
April 7, 2017 – Developer responds.
April 13, 2017 -Vulnerability disclosed independently of us.

Concerned About The Security of the Plugins You Use?

When you are a paying customer of our service, you can suggest/vote for the WordPress plugins you use to receive a security review from us. You can start using the service for free when you sign up now. We also offer security reviews of WordPress plugins as a separate service.

Plugin Vulnerabilities

A service to protect your site against vulnerabilities in WordPress plugins.

Leave a Reply Cancel reply