Aerosol Posted March 10, 2015 Report Share Posted March 10, 2015 Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin. contents:: Table Of ContentOverviewTitle :Stored XSS Vulnerability in Google Analytics by Yoast Wordpress PluginAuthor: Kaustubh G. Padwad, Rohit Kumar.Plugin Homepage: https://yoast.com/wordpress/plugins/google-analytics/Severity: MediumVersion Affected: Version 5.3.2 and mostly prior to itVersion Tested : Version 5.3.2version patched:DescriptionVulnerable ParameterCurrent UA-ProfileManually enter your UA codeLabel for those linksSet path for internal links to track as outbound links:Subdomain tracking:Extensions of files to track as downloads:About VulnerabilityThis plugin is vulnerable to a Stored Cross Site Scripting vulnerability,This issue was exploited when administrator users with access to "Google Analytics by Yoast" Setting in wordpress above listed vulnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.Vulnerability ClassCross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)Steps to Reproduce: (POC)After installing the pluginGoto settings --> Google Analytics by YoastInput this payload in "Manually enter your UA code" :- v style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">xClick on the Save Changes button and navigate your cursor to input box,you will see XSS in actionReload the page or re navigate to page to make sure its stored Mitigationhttps://github.com/Yoast/google-analytics-for-wordpress/pull/322/commitsChange Loghttps://github.com/Yoast/google-analytics-for-wordpress/pull/322/commitsDisclosure22-February-2015 Reported to developer25-February-2015 Fixed by developer05-March-2015 Issue Closed with team.06-March-2015 Public DisclosercreditsKaustubh Padwad & Rohit KumarInformation Security Researcherkingkaustubh@me.com & kumarrohit2255@gmail.com @s3curityb3ast,@rkumars3c[url]http://breakthesec.com[/url][url]https://www.linkedin.com/in/kaustubhpadwad[/url]Source Quote Link to comment Share on other sites More sharing options...