WordPress Plugin OptinMonster Popups on 500 thousand sites allows unauthenticated users to admin backend

wefightforsecurityJuly 11, 2017July 14, 2017cyber security, Uncategorized, wordpress security

Update: upon further review we reaffirm our post, but make the following annotation; the severity of this issue maybe less then originally thought. We are continuing our evaluation and we will post our findings.
update: We completed our review of the code in the screenshot of this post and while we identified variables that would lead to severe vulnerabilities, we have not been able to find use of the vulnerable variables, however the classes are still vulnerable and need to be updated. The severity of this particular problem is low.

The WordPress plugin Optinmonster API has left over 500 thousand sites vulnerable to a security flaw. Thankfully we have a fix you can buy for this one vulnerability.

During our code review we discovered that the admin area is protected by a WordPress function called is_admin, which is a misunderstood function, that allows admins and unauthenticated users alike to access the information in optinmonster API. What does this mean to you, the user? It means that you can access the admin features, but so can criminals.

What does optinmonster protect using is_admin? At first glance it is just one line of code, so how bad could that actually be? It turns out that one line of code as you can tell is calling almost all of the rest of the code in the application.

optin monster api vulnerable

Yes, the one line of code load_admin, loads everything that should be administrator only, but instead is accessible for all.

As you can tell above, the administrator menu, admin actions, reviews the admin has access to, the welcome page, the site content and the ability to save content among other things are accessible to anyone or any bot who logs onto the site. This is a severe vulnerability leaving the admin side of your site vulnerable, so we have written a patch for this one vulnerability in the WordPress plugin Optinmonster, also known as Optinmonster API. You can buy the more secure version of the WordPress optinmonster plugin on our site. We may patch more vulnerabilities in this plugin, but we can say that our version of WordPress plugin optinmonster is currently more secure then what is available and we can continue to update it to be more secure.

We provide updates for any plugin with over 500 thousand users for premium customers, all they have to do is ask us tell us what plugins they’re using that are popular and we will check the security of them.

Number Theory Attack On Two factor Authentication research

wefightforsecurityJuly 7, 2017July 19, 2017Uncategorized

What you are about to read is research that at this point has only been proven on paper repeatedly over a thousand times and has had the support of being peer reviewed countless times, with no one being able to disprove it in the last two years. Why did we make this research public? What are we claiming? We made it public to see if people can take it from paper to proof of concept or if they can take it from paper to disproven or a proven proof of concept. So what we are claiming is simple, we were able to know which TOTP token would be generated, because of a flaw in the TOTP, which seems to originate in the underlying sha-1 with a potential number theory attack. This has been peer reviewed by Mr. Edwards, also known as @Lojikil, who came to that conclusion. We are adding in more clarification to help those reviewing it.

Our TOTP research that lead to a potential number theory attack. Our research has been wanted to be seen by the information security community for sometime and has passed all peer reviews it’s been through, so we are confident in sharing it. We are more focused on the accuracy of this article, then trying to make it easy to understand for the average user in this post.

If you pass data through sha-1 you are hashing that data, so by design you aren’t supposed to be able to accurately guess or discover what the actual message is by tampering with the hash. 2fa uses TOTP which if you dig deep enough into TOTP it uses sha-1 and TOTP only uses the last four bytes of each hash plus the time of the users computer. We haven’t been able to get enough power to automate the process to prove the number theory attack that leads to being able to crack 2fa and we have to account for the possibility that Google may have patched without informing or paying us, but this effects all 2fa implementations, so please take Google 2fa responses with a grain of salt. The reason we say this is because we reported the bug to Google and they’ve patched issues while saying they won’t in the past, so we currently distrust their public bounty program.

Since our research passed peer review, we are now putting out for the entire information security community to review, so without any further delay, let’s get to it. Please note, that we will be explaining everything that took place.

when researching the TOTP tokens in two factor authentication, their are only six digits long and only consists of numeric values, except for one rare instance where it was alphanumeric.

We figured out what the next TOTP token would most likely be before it is ever sent and doesn’t require any user interaction nor does it require having access to any device. When analyzing the numbers generated by the TOTP token we noticed they weren’t even close to random. Per our research, the TOTP generator numbers can be cracked because, while they may take a lot of code to generate a TOTP token, it only takes 0,1,2, and 3 and is also allowed to use one decimal that is either .1 .2 or .3 using our number theory attack against it.

The above statement has been misinterpeted by a researcher who thought we were claiming a 1 can’t be followed by an eight. That is indeed possible in two different ways. One we do not claim that the last number is used to create the next number, our claim is pretty clear. You could use 2.333 * 3.333 to get roughly to eight, which then appears to be rounded up to 8 by the code.

When 2fa is enabled one code is given per minute in google authenticator which google says to use. This means you have 60 seconds to create a collision , so the computational power needed to crack it within sixty seconds is a lot. If you would like to peer review a bunch of very old TOTP tokens , you can at the bottom of this post along with an explanation on the math formula used to generate each number.

We do not know if our research expands into all sha-1, since this is still on paper research, despite the extensive review of it. This is a number theory attack that in this instance is targeting the TOTP and the underlying sha-1, thus making 2fa tokens insecure if this is indeed proven to be correct in a working proof of concept. Currently in theory, it hasn’t been disproven. It would take a lot of power to generate an accurate 2fa token in under sixty seconds, which is the amount of time you have with Google’s utilization of the TOTP. Google believes their security is good enough and negated the severity of our research due to the amount of computational power it would take to create a number theory attack with a six digit 2fa number in under sixty seconds.

So, what does this mean to the average person? If this is proven, 2fa is indeed broken and anyone can create their own valid 2fa tokens. The reason we are going public with this, is because we want security improvements to sha-1 to better protect the end user, and we are doing our best to be transparent with the information security community.

Here are just a few tokens that we’ve proven the math to, but we’ve repeated this process a thousand times.
672704

Now let’s break down the math to recreate the token 672704

6+1=7

7 divided by 3.3 = 2

2 times 3.3 = 7

7 times 0 = 0

2+2 = 4 or you could also do 7 – 3 = 4

Now you are going to have noticed that there is an abnormality in the math for the 4? What is that abnormality? It doesn’t use the last number to generate the new number and the reasoning behind this seems straight forward to us, but for those who are looking at this for the first time, here is the explanation. Once you hit 0, you can’t create the next number, unless you use the number, in this case 7 that created the 0 or it potentially may have to start from scratch, however we have yet to encounter that. We provided the math for 4 using 2+2 which jumps back two numbers to the 2 before the 7 or simply reusing the number that created the 0, which in this case is 7.

Now let’s do this one more time before you just go through all the math on your own. Here is the token 433034

4-1=3

3-0=3

3-3=0

0+3=3

3+1=4

It follows the same pattern as the last token, so let’s do it again for redundancy sake with 500349

3 + 2 = 5

5 * 0= 0

0 * 0 = 0

Now, we go back to the only valid number like before, which is 5.

5 – 2 = 3

3 + 1 = 4

4 * 2.3 = 9.2 which is rounded down to 9.

Now, let’s look at the underlying math that can be applied to each number to crack it. We look forward to any type of criticism.

Now, let’s break down our math, so it’s easier to digest. 2*3 equals six 3*2.3 = a rounded down 7 7+1=8 6+3=9 and so on. We were exhausted by all our research and in very rare instances we use x as a place holder, since we didn’t spend much time on that number. You can do all the work on this research as you want. What follows are tokens broken down into the math uses to create them

2*3=6 3*2.3=7 7+1=8 6+3=9 9*0=0
8 / 2.3 = 3 2+2=4 5+0=5 2 *3.3=7 4*2=8 3*3=9

1+2=3 4+0=4 5/1=5 5*1.3=8 4*2.3=9
5-2=3 8/2=4 6+2=8

7 / 3 = 2 7 divided by 2.3=3 9/2.2=4 9-1=8

0+1=1 9/3.3=2 6-3=3

1+1=2 4-1=3
3-2=1 2+0=2 1+2=3
2-1=1 8/3.3=2 9 divided by 3=3

9 modulo 2=1 3+0=3

9-3.3=5
446055 4+0=4 4+2=6 6*0=0 5 5+0=5
278888 2 * 3.3=7 7+1=8 8+0=8 8+0=8 8+0=8
410106 4-3=1 1*0=0 0+1=1 1*0=0 6
793700 7+2=9 9 divided by 3=3 3 times 2.3=7 7*0=0 0*0=0
208789 2*0=0 x=8 7+1=8 8+1=9
012124 0+1=1 1+1=2 2-1=1 1+1=2 2+2=4
768646 7-1=6 6+2=8 8-2=6 6-2=4 4+2=6
269109 2*3=6 6+3=9 8 modulo 2=1 1-1=0 9
182458 8/3.3=2 2+2=4 4+1=5 5+3=8
505491 5*0=0 5-1=4 4*2.3=9 9 modulo 2=1
770653 7+0=7 7*0=0 6-1=5 5-2=3
795155 7+2=9 9-3.3=5 5/1=5 5+0=5
657034 6-1=5 5+2=7 7*0=0 0+3=3 3+1=4
533718 5-2=3 3+0=3 3 3*2.3=7 modulo 2=1 8
854176 8-3=5 5-1=4 4-3=1 x=7 7-1=6
831309 8 divided by 2.3 = 3 3-2=1 1+2=3 3*0=0 9
320686 3-1=2 2*0=0 6+2=8 8-2=6
069834 6+3=9 9-1=8 8 divided by 2.3 = 3 3+1=4
343546 3+1=4 4-1=3 3+2=5 5-1=4 4+2=6
671395 6+1=7 7 divided by 2.2=3 3 times 3=9 9*0=0
730796 7 divided by 2.3=3 3*0=0 7+2=9 9-3=6
445720 4+0=4 4+1=5 5+2=7 7 divided by 3=2 2–2=0
739794 7 divided by 2.3 = 3 3*3=9 9-2=7 7+2=9 9 divided by 2.2=4
085745 8-3=5 5+2=7 7-3=4 4+1=5

50 thousand WordPress sites use Paid membership WP Plugin & suffer from SQL injection & CSRF to stored XSS

wefightforsecurityJuly 6, 2017July 6, 2017cyber security, wordpress security

Update: A new version of Paid memberships pro has been released to the WordPress repo, fixing the CSRF to stored XSS issue written about below, however anyone using paid memberships pro 1.9.2 or lower is still vulnerable. The sql injections still exist in many areas of the code, however some areas are protected, which we had yet to review. It does show improvement that two issues were fixed so quickly by the developer.

Paid Membership pro is a WordPress plugin that helps people buy your products and or services and is used on over 50 thousand sites, sadly the security is lacking. We were reviewing the plugin and discovered it is vulnerable to everything from sql injections and CSRF to stored XSS.While our information is usually locked down to paying customers, we decided it was in the best interest of the WordPress community to publicly expose these flaws. As always, Jetpack which is owned by Automattic reports this plugin as safe, due to the flawed way Jetpack decides if something is safe or not, which sadly gives users a false sense of security.

Incorrect security alert from Jetpack on Paid Memberships Pro

We reported Paid membership pro to WordPress security who removed the plugin from the WordPress repo. Unfortunately, removing a plugin from the WordPress repo does not help the affected users. Due to this problem, we believe public disclosure is best, especially since rewriting the plugin to fix all the issues in a timely manner would take a team of several people working solely on that project.

How is WordPress plugin Paid membership pro vulnerable to SQL injections?

This is a good question for those who aren’t used to security issues and the reason is simple. The developer either didn’t know about sql injection or didn’t know what to do about it. The code executes sql queries with little to no protection against sql injection. To put it simply, information that went into the database was not protected against criminals or researchers from manipulating data in the WordPress database, stealing all the data or doing whatever they like.

How is Paid Membership pro vulnerable to CSRF to stored XSS?

First it is important to explain that cross site request forgery, also known as CSRF and s XSS are two seperate security vulnerabilities tied together creating far more damage to the users site. CSRF allows a a researcher or criminal to copy a form or other code that needs CSRF protection to another website and then can trick a user to go to the site thus forcing them to unknowingly and unwittingly cause damage to their own website. In this case you had to be logged in as an admin who is tricked into clicking a damaging link. Again, in the case of the WordPress plugin Paid membership pro, the form in question is also vulnerable to stored XSS. Stored XSS, also known as stored cross site scripting allows a researcher or criminal to inject their own code into another website, whether that code causes damage or not is fully up to the attacker. In this case it caused defacement of the logged in admin panel and the site for users who are just visiting the site, which would’ve allowed the attacker to easily gain control of the entire WordPress site and cause damage to the users and the companies brand.

Here is an image of the stored XSS on Paid membership pro, where we simply made it show the number 1 to demonstrate that code could be ran. Any code, malicious or otherwise could’ve ran just for those who don’t understand that.

Paid membership pro xss exploit example

Where is WordPress plugin paid membership pro vulnerable to CSRF to stored XSS?

step 1: For csrf to stored xss login as admin and go to the admin panel.
Step 2: go to memberships and then click on add new membership level
step 3: There is no CSRF protection protecting this page, so it is vulnerable to CSRF.
Step 4: Go to parameter name and add in a simple ‘”><Script>
alert`1`</script> to get the vulnerability as seen above.

What should you do to protect yourself? At this point in time the only option is to switch plugins or have your team rewrite the code of the plugin, which is quite a task.

The best way to help protect other users is to share this article with others and alert them to this problem. If you want access to more WordPress security alerts and informative articles like this you will want to access our WordPress Plugin Security alerts. We will be doing write ups on plugins affecting over 200 thousand sites and another that affects 3 million sites for those who pay for access. We have yet to make our automated WordPress security plugin tool to automatically post to WordPress, so in the meantime we will provide updates for our customers often.

Month: July 2017