The plugin WooCommerce Variation Swatches (Variation Swatches for WooCommerce) was closed on the WordPress Plugin Directory yesterday. That is one of the 1,000 most popular plugins with 60,000+ installs, so we were alerted to its closure. While we were looking in to the plugin to see if there were any vulnerabilities we should be warning users of the plugin that also use our service, we found that it contains a reflected cross-site scripting (XSS) vulnerability.

The plugin’s admin page is made accessible to WordPress user with the “edit_theme_options” capability:

92

add_menu_page( $page_title, $menu_title, 'edit_theme_options', $this->slug, array( $this, 'settings_form' ), 'dashicons-admin-generic', 31 );

Though oddly the function that runs when accessing that first restricts access to users with a different capability, “manage_options”:

456
457
458
459

public function settings_form() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( __( 'You do not have sufficient permissions to access this page.' ) );
	}

Normally only Administrators would have either of those.

In that function the function last_tab_input() is called:

493

$this->last_tab_input();

That will output the result of another function, get_last_active_tab(), without escaping it:

501
502
503

private function last_tab_input() {
	printf( '<input type="hidden" id="_last_active_tab" name="%s[_last_active_tab]" value="%s">', $this->settings_name, $this->get_last_active_tab() );
}

That function in turn will return the value of the GET input “tab” if exists, without validating, sanitizing or escaping it:

530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548

private function get_last_active_tab() {
 
	$last_tab = trim( $this->get_option( '_last_active_tab' ) );
 
	if ( isset( $_GET[ 'tab' ] ) && ! empty( $_GET[ 'tab' ] ) ) {
		$last_tab = trim( $_GET[ 'tab' ] );
	}
 
	$default_tab = '';
	foreach ( $this->fields as $tabs ) {
		if ( isset( $tabs[ 'active' ] ) && $tabs[ 'active' ] ) {
			$default_tab = $tabs[ 'id' ];
			break;
		}
	}
 
	return ! empty( $last_tab ) ? $last_tab : $default_tab;
 
}

So an attacker who could get an Administrator to visit a URL they generated with malicious JavaScript code in the “tab” parameter could cause the malicious JavaScript to be loaded on the page. Major web browser other than Firefox include XSS filtering that will limit the ability for that code to run, combined with the targeted nature of this type of attack, at this time hackers are not trying to exploit this type of vulnerability on a wide scale.

Full Disclosure

Due to the moderators of the WordPress Support Forum’s continued inappropriate behavior we are full disclosing vulnerabilities in protest until WordPress gets that situation cleaned up, so we are releasing this post and then leaving a message about that for the developer through the WordPress Support Forum. You can notify the developer of this issue on the forum as well. Hopefully the moderators will finally see the light and clean up their act soon, so these full disclosures will no longer be needed (we hope they end soon). You would think they would have already done that, but considering that they believe that having plugins, which have millions installs, remain in the Plugin Directory despite them knowing they are vulnerable is “appropriate action”, something is very amiss with them (which is even more reason the moderation needs to be cleaned up).

Update: To clear up the confusion where developers claim we hadn’t tried to notify them through the Support Forum (while at the same time moderators are complaining about us doing just that), here is the message we left for this vulnerability:

Is It Fixed?

If you are reading this post down the road the best way to find out if this vulnerability or other WordPress plugin vulnerabilities in plugins you use have been fixed is to sign up for our service, since what we uniquely do when it comes to that type of data is to test to see if vulnerabilities have really been fixed. Relying on the developer’s information, can lead you astray, as we often find that they believe they have fixed vulnerabilities, but have failed to do that.

Proof of Concept

The following proof of concept will cause any available cookies to be shown in an alert box, when logged in as an Administrator. Major web browsers other than Firefox provide XSS filtering, so this proof of concept will not work in those web browsers.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-admin/admin.php?page=woo-variation-swatches-settings&tab="><script>alert(document.cookie);</script>

Concerned About The Security of the Plugins You Use?

Need Continued Support for a Closed Plugin?