Keep Hacking

Subscribe Now

Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin

By SecurityB3ast Posted On 2:06 AM // 6 comments

Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin

.. contents:: Table Of Content

Overview

  • Title :Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin
  • Author: Kaustubh G. Padwad, Rohit Kumar.
  • Plugin Homepage: https://yoast.com/wordpress/plugins/google-analytics/
  • Severity: Medium
  • Version Affected: Version 5.3.2 and mostly prior to it
  • Version Tested : Version 5.3.2
  • version patched:

Description

Vulnerable Parameter

  • Current UA-Profile
  • Manually enter your UA code
  • Label for those links
  • Set path for internal links to track as outbound links:
  • Subdomain tracking:
  • Extensions of files to track as downloads:

About Vulnerability

This plugin is vulnerable to a Stored Cross Site Scripting vulnerability,This issue was exploited when administrator users with access to "Google Analytics by Yoast" Setting in wordpress above listed vulnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.

Vulnerability Class

Steps to Reproduce: (POC)

After installing the plugin
  • Goto settings --> Google Analytics by Yoast
  • Input this payload in "Manually enter your UA code" :- v style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x
  • Click on the Save Changes button and navigate your cursor to input box,you will see XSS in action
  • Reload the page or re navigate to page to make sure its stored ;)
POC
POC

Mitigation

Change Log

Disclosure

22-February-2015 Reported to developer
25-February-2015 Fixed by developer
05-March-2015 Issue Closed with team.
06-March-2015 Public Discloser

credits

Labels: , , , , ,

6 comments:

  1. UnknownDecember 15, 2015 at 11:38 AM

    Thanks for your informative post. Your article helped me a lot to understand the future of digital marketing. SEO Training in Chennai | Digital Marketing Training in Chennai

    ReplyDelete
  2. UnknownDecember 18, 2015 at 2:56 PM

    Digital Marketing is a kind of marketing strategy that relies on electronic medium like television, internet and mobile in promoting a product. It delivers incredible result to the business owners to boost their business online presence and enjoy maximum leads. SEO Training in Chennai | SEO Course in Chennai

    ReplyDelete
  3. AdhunttFebruary 27, 2019 at 4:38 PM

    Nice article Instagram and Facebook have provided an amazing place for new brands to grow and flourish. We can find the perfect niche for your brand on the best social media platforms.

    ReplyDelete
  4. UnknownAugust 1, 2019 at 5:16 PM

    Thanks for sharing an informative blog keep rocking bring more details.I like the helpful info you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite sure I will learn much new stuff right here! Good luck for the next!
    Google ads services
    Google Ads Management Services
    Google Ads Management Company
    Google advertising agency
    Google Ads Management agency
    Google ad services on phone

    ReplyDelete
  5. thrishulaNovember 29, 2019 at 4:18 PM

    So off plugins. Now I use INK for All, this text editor with a built-in AI that optimizes content. Ever heard of this? http://bit.ly/2XUjrhu

    ReplyDelete
  6. pavithra dassDecember 23, 2019 at 6:50 PM

    Good job! Fruitful article. I like this very much. It is very useful for my research. It shows your interest in this topic very well. I hope you will post some more information about the software. Please keep sharing!!
    SEO Training in Chennai
    SEO Training in Bangalore
    SEO Training in Coimbatore
    SEO Training in Madurai
    SEO Course in Chennai
    SEO Course in Chennai
    SEO Course in Bangalore
    SEO Course in Coimbatore

    ReplyDelete