WordPress · Report #230232

Stored self-XSS in mercantile.wordpress.org checkout

Validstatus

lowseverity

15upvotes

14 Jul 2017disclosed

Summary

thanks to WordPress team and sir Iandunn, really fast on response and take action. kudos to Portswigger Web Security regarding the payload also thanks to codertom for his report at https://hackerone.com/reports/221893, and here #222224 You made me think that more could be done.

I owe you a beer :)

How it was found

Hello Team,

Summary after i read this #221893 report, i try to find more security issue there, and i was surprise i found an RCE Via Template Injection. Since on that report i see ng-bindable word, its possible the site also effect by RCE.

Step To Reproduce

open https://mercantile.wordpress.org and sign up for account.
after finish sign up navigate to https://mercantile.wordpress.org/my-account/edit-account/ to field your first and last name
now navigate again to https://mercantile.wordpress.org/my-account/edit-address/
field all form for Billing Address with {{1+1}} except the zip code and field all form with {{1==1}} for the Shipping Address. and press save.

{F186514}

now try to make an order by select any product till process or step to https://mercantile.wordpress.org/checkout/
there you will see, the code {{1+1}} that we have field in the form for address bellow is execute as 2 automaticly there. and the {{1==1}} in shipping address will be execute as true .

{F186513}

This is a vulnerability about Flask Template Engine(Jinja2) Injection or Angular JS Template Injection , more detail can be seen in these blogs for your Reference:

Best Regards,

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original