------------------------------------------------------------------------ Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A persistent Cross-Site Scripting vulnerability was found in the Instagram Feed plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0014 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on the Instagram Feed [2] WordPress Plugin version 1.4.6.2. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue is resolved in Instagram Feed [3] WordPress Plugin version 1.4.7. ------------------------------------------------------------------------ Introduction ------------------------------------------------------------------------ Instagram Feed is a WordPress plugin to display beautifully clean, customizable, and responsive feeds from multiple Instagram accounts. A persistent Cross-Site Scripting vulnerability was found in the Instagram Feed plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a URL provided by an attacker. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ The settings page of the Instagram Feed plugin does not perform CSRF checks. It's possible to change all settings in the plugin by making an authenticated administrator perform a request to change the settings (CSRF). It's possible to change the Instagram access token and id to show images of other users. It's also possible to inject malicious JavaScript in the Customize section, to perform Persistent Cross-Site Scripting. Any user visiting the Instagram Feed will be injected with the attackers payload after the CSRF attack. ------------------------------------------------------------------------ Proof of Concept ------------------------------------------------------------------------ Have an authenticated admin visit a webpage with the following form: The Custom JavaScript section will now be saved with the attacker's JavaScript payload.[h3]References[/h3] [1] https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_instagram_feed_plugin_via_csrf.html [2] https://wordpress.org/plugins/instagram-feed/ [3] https://downloads.wordpress.org/plugin/instagram-feed.1.4.7.zip