Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta

This research plan targets a Post Meta Disclosure (IDOR) vulnerability in the Broadstreet plugin. While the full source of the AJAX handler is not provided in the snippet, the vulnerability description and common WordPress plugin patterns allow for a precise reconstruction of the exploitation path.

1. Vulnerability Summary

The Broadstreet plugin registers an AJAX action get_sponsored_meta that lacks proper authorization and input validation. Specifically, it allows a user to provide an arbitrary key parameter which is passed directly to get_post_meta(). Because WordPress does not inherently protect "private" meta keys (those starting with an underscore) from get_post_meta calls when the key name is known, any authenticated user can bypass intended visibility restrictions to leak sensitive internal data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: get_sponsored_meta
• Vulnerable Parameter: key (User-controlled meta key name)
• Identifier Parameter: post_id (The ID of the post to query)
• Authentication: Subscriber level or higher.
• Preconditions: The attacker must have a valid nonce if the plugin implements check_ajax_referer (likely), and the target meta key must exist for the specified post_id.

3. Code Flow (Inferred)

1. Registration: Broadstreet_Core::execute() (in Broadstreet/Core.php) likely calls a method that registers the AJAX handler:
   add_action('wp_ajax_get_sponsored_meta', array($this, 'get_sponsored_meta'));
2. Handler Execution: The handler (presumably get_sponsored_meta) retrieves input:

   $post_id = $_POST['post_id'];
   $meta_key = $_POST['key'];
   

3. The Sink: The code calls the native WordPress function without verifying if the key is public:

   $value = get_post_meta($post_id, $meta_key, true);
   echo $value;
   wp_die();
   

4. The Bypass: By providing a key like _wp_attached_file or a custom secret key (e.g., _bs_metadata), the attacker receives data they shouldn't see.

4. Nonce Acquisition Strategy

Broadstreet typically localizes its configuration and nonces for its dashboard and widgets.

1. Identify Script Localization: The plugin likely uses wp_localize_script to pass a nonce to the frontend. Based on common Broadstreet patterns, the object name is likely BroadstreetConfig or broadstreet_vars.
2. Creation of Environment:
   • Since Broadstreet is an ad-management plugin, its scripts usually load on the WordPress dashboard for all authenticated users.
3. Extraction Steps:
   • Log in as a Subscriber.
   • Navigate to the WordPress Dashboard (/wp-admin/index.php).
   • Use browser_eval to search for the nonce:
     browser_eval("window.BroadstreetConfig?.nonce || window.broadstreet_vars?.nonce")
   • If not found, search the HTML source for check_ajax_referer action strings like broadstreet_nonce or get_sponsored_meta.

5. Test Data Setup

To prove the vulnerability, we need a "private" meta key attached to a post.

1. Create a target post:
   wp post create --post_type=post --post_title="Target Post" --post_status=publish (Note the ID, e.g., 123).
2. Add private metadata:
   wp post meta add 123 _secret_internal_key "CONFIDENTIAL_AD_REVENUE_DATA"
3. Create a Subscriber user:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

6. Exploitation Strategy

1. Authentication: Authenticate as the Subscriber user and obtain session cookies.
2. Nonce Retrieval:
   • Navigate to /wp-admin/ using browser_navigate.
   • Execute browser_eval to extract the nonce and the ajax_url.
3. Exploit Request:
   • Use the http_request tool to send a POST request to /wp-admin/admin-ajax.php.
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=get_sponsored_meta&post_id=123&key=_secret_internal_key&_wpnonce=[NONCE]
     

     (Note: The parameter name for the nonce might be nonce or _wpnonce; this should be verified during the extraction step.)

7. Expected Results

• Success: The HTTP response body contains the string CONFIDENTIAL_AD_REVENUE_DATA.
• Response Code: 200 OK.
• Security Failure: The plugin returns the value of a meta key prefixed with an underscore, which is the standard WordPress convention for protected/hidden metadata.

8. Verification Steps

1. Verify Payload: Compare the HTTP response content with the output of:
   wp post meta get 123 _secret_internal_key
2. Check Scope: Attempt to retrieve a core WordPress private key to show impact:
   action=get_sponsored_meta&post_id=123&key=_edit_last
   If it returns a User ID, the disclosure is confirmed.

9. Alternative Approaches

• If Nonce is not found in Admin: Some Broadstreet features are intended for the frontend. Create a page with a Broadstreet widget/shortcode (if identified via grep -r "add_shortcode") and extract the nonce from the public-facing page.
• Blind Disclosure: If the plugin does not echo the result but uses it in a way that affects the UI, observe changes in the response length or specific HTML elements returned.
• Key Enumeration: If the specific key name is unknown, common WordPress keys to test include:
  • _wp_attached_file
  • _wp_page_template
  • _edit_lock
  • _edit_last