Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'

This research plan targets a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Voice Mail plugin (<= 1.2.5). The vulnerability allows unauthenticated users to inject malicious scripts into the message parameter of a voicemail submission, which is then executed in the context of an administrator viewing the voicemail in the WordPress dashboard.

---

1. Vulnerability Summary

• Vulnerability: Stored Cross-Site Scripting (XSS)
• Vulnerable Parameter: message
• Plugin Slug: easy-voice-mail
• Affected Versions: <= 1.2.5
• Sink: The admin-facing "Messages" or "Inbox" page where voicemails are displayed.
• Cause: The plugin fails to sanitize the message input during submission and fails to escape it during output in the administrative interface.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: evm_save_message or evm_send_message (inferred from typical plugin naming conventions; to be verified in source).
• Authentication: Unauthenticated (wp_ajax_nopriv_ hook).
• Payload Location: The message POST parameter.
• Preconditions: A page or post must contain the Easy Voice Mail shortcode (likely [easy-voice-mail]) to provide the necessary nonce and environment for the AJAX request.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user accesses a public page containing the voicemail recording interface.
2. Input: The user completes a "recording" or "submission" process. The frontend JS sends an AJAX request to admin-ajax.php with an action (e.g., evm_save_voicemail) and the message parameter.
3. Processing: The PHP handler (e.g., save_message_callback) receives $_POST['message']. It likely saves this data to the database (either a custom table like {$wpdb->prefix}evm_messages or as a custom post type evm_message) without calling sanitize_text_field() or wp_kses().
4. Storage: The payload <script>alert(document.domain)</script> is stored raw in the database.
5. Sink: An administrator logs in and navigates to the "Easy Voice Mail" management page (e.g., wp-admin/admin.php?page=easy-voice-mail-messages).
6. Execution: The admin page retrieves the messages and outputs the message content directly: echo $message_data->message; without using esc_html().

4. Nonce Acquisition Strategy

The plugin likely uses wp_localize_script to pass a nonce and the AJAX URL to the frontend.

1. Identify Shortcode: Search the plugin source for add_shortcode.
   • Search command: grep -rn "add_shortcode" .
2. Create Test Page: Create a public page containing the identified shortcode.
   • Command: wp post create --post_type=page --post_status=publish --post_title="Voicemail" --post_content='[easy-voice-mail]' (assuming the slug).
3. Navigate and Extract: Use browser_navigate to visit the new page.
4. Variable Extraction: Use browser_eval to find the localization object. Look for evm_ajax, evm_settings, or similar.
   • Likely JS path: window.evm_settings?.nonce or window.evm_ajax_obj?.nonce.
   • Search command for variable: grep -rn "wp_localize_script" . to find the object name and key.

5. Exploitation Strategy

1. Setup: Install the plugin version 1.2.5. Create an admin user and a public page with the shortcode.
2. Nonce Retrieval:
   • Navigate to the public page.
   • Extract the nonce via browser_eval.
3. Payload Delivery:
   • Use http_request to send a POST request to /wp-admin/admin-ajax.php.
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body:

     action=evm_save_message&nonce=[EXTRACTED_NONCE]&message=<script>alert('XSS')</script>&name=Attacker&email=attacker@example.com
     

   • Note: The exact action and parameter names (name, email) must be verified by grepping add_action( 'wp_ajax_nopriv_... in the plugin code.
4. Triggering: Navigate to the plugin's message list in the admin dashboard using browser_navigate as the administrator.

6. Test Data Setup

• Plugin: Easy Voice Mail v1.2.5.
• Page: A published page with the [easy-voice-mail] (or correct slug) shortcode.
• Admin User: Pre-authenticated session for the PoC agent to verify the execution.

7. Expected Results

• The AJAX submission should return a success status (e.g., {"success":true} or 1).
• When the admin dashboard page is loaded, a JavaScript alert should trigger, or the script tag should be visible in the raw HTML source of the message list page.

8. Verification Steps

1. Database Check: Use WP-CLI to check if the message was stored:
   • Command: wp db query "SELECT * FROM wp_evm_messages;" (adjust table name if it uses post meta).
2. HTML Source Check: Use http_request as an admin to fetch the message list page and grep for the payload.
   • Command: Check if <script>alert('XSS')</script> appears unencoded in the response body.

9. Alternative Approaches

• Post Meta Sink: If the plugin stores messages as Custom Post Types, the XSS might trigger on the edit.php?post_type=evm_message screen or inside the Gutenberg editor when the admin opens the specific "voicemail" post.
• Email Sink: If the plugin sends an email notification to the admin with the message content, the XSS could trigger in webmail clients that do not sanitize HTML (less likely to be the primary CVSS vector but a valid impact).
• Direct Post: If the AJAX handler doesn't check nonces (or uses the default -1), the attack is even simpler. Check the handler for check_ajax_referer or wp_verify_nonce.