Exploitation Research Plan - CVE-2025-69311 (Broadstreet Ads)

1. Vulnerability Summary

The Broadstreet Ads plugin for WordPress (versions <= 1.52.1) contains a missing authorization vulnerability within its AJAX handlers. While the plugin implements nonce checks for its administrative actions, it fails to verify if the requesting user possesses the necessary capabilities (e.g., manage_options). This allows any authenticated user with Subscriber-level access or higher to trigger sensitive administrative functions, such as refreshing or dropping ad zones and clearing plugin caches.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: broadstreet_refresh_zones, broadstreet_drop_zones, or broadstreet_clear_cache (inferred based on plugin functionality).
• HTTP Method: POST
• Authentication: Authenticated (Subscriber-level required).
• Preconditions: The plugin must be active. For broadstreet_refresh_zones to have visible impact, a Broadstreet API key is typically configured, though the unauthorized execution of the function itself is the vulnerability.

3. Code Flow

1. Registration: The plugin registers AJAX actions in the main plugin class (likely Broadstreet_Core or Broadstreet_Utility) using:
   add_action('wp_ajax_broadstreet_refresh_zones', array($this, 'handle_refresh_zones')); (inferred).
2. Execution: When a Subscriber sends a request to admin-ajax.php?action=broadstreet_refresh_zones:
3. Nonce Check: The handler function calls check_ajax_referer('broadstreet_nonce', 'nonce') or wp_verify_nonce().
4. Authorization Gap: The handler omits a call to current_user_can('manage_options').
5. Logic Sink: The plugin proceeds to execute administrative logic (e.g., making an API call to Broadstreet or modifying the wp_options table to clear zone data).

4. Nonce Acquisition Strategy

The Broadstreet plugin localizes its configuration data for the admin interface. Even though a Subscriber cannot access the Broadstreet settings page, the plugin often enqueues its scripts on all admin pages or for all logged-in users to support dashboard widgets.

1. Identify the Script: Look for the script handle broadstreet-admin or similar.
2. Access the Nonce: The nonce is typically stored in a global JavaScript object.
3. Execution Agent Steps:
   • Create a Subscriber user.
   • Use browser_navigate to go to /wp-admin/index.php as the Subscriber.
   • Use browser_eval to extract the nonce: browser_eval("window.broadstreet_data?.nonce") (inferred variable name).
   • If broadstreet_data is not found, search the source for any object containing a 10-character alphanumeric nonce.

5. Exploitation Strategy

We will attempt to trigger the broadstreet_refresh_zones action, which forces the plugin to re-sync with the Broadstreet API, an action that should be restricted to administrators.

• Request Type: POST
• URL: http://[target]/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: broadstreet_refresh_zones
  • nonce: [EXTRACTED_NONCE]

Payload Example:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Cookie: [Subscriber_Cookies]

action=broadstreet_refresh_zones&nonce=a1b2c3d4e5

6. Test Data Setup

1. Install Plugin: Ensure Broadstreet Ads <= 1.52.1 is installed and activated.
2. Create User:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
3. Optional Configuration: If the refresh_zones logic requires an API key to proceed past the initial check, set a dummy key:
   wp option update broadstreet_api_key "dummy_key"

7. Expected Results

• Success: The server responds with a 200 OK and a JSON response (e.g., {"success": true}) or a redirect. The plugin logs or database should reflect that a zone refresh was initiated.
• Vulnerability Confirmation: If a Subscriber can trigger the logic, the missing capability check is confirmed.
• Failure: The server responds with 403 Forbidden or 0 (if the nonce is invalid or the capability check was actually present).

8. Verification Steps

1. Check Options: Use WP-CLI to see if the "last refresh" timestamp has updated in the plugin's options.
   wp option get broadstreet_settings (Look for last_refresh or similar keys).
2. Log Observation: If debug logging is enabled, check for entries from the handle_refresh_zones function.

9. Alternative Approaches

If broadstreet_refresh_zones is not the vulnerable endpoint, attempt the same process with:

• Action: broadstreet_drop_zones
  • Impact: This is higher impact as it deletes local zone cache data.
  • Verification: wp option get broadstreet_zones should return empty or reflect deletion.
• Action: broadstreet_clear_cache
  • Impact: Clears the plugin's internal cache.

If the nonce is not available on the Subscriber's dashboard, check if the plugin registers a frontend AJAX action (wp_ajax_nopriv_) which would bypass the Subscriber requirement entirely (though the CVE suggests Subscriber+).