{"action":"closed","issue":{"url":"https://api.github.com/repos/Yoast/google-analytics-for-wordpress/issues/319","labels_url":"https://api.github.com/repos/Yoast/google-analytics-for-wordpress/issues/319/labels{/name}","comments_url":"https://api.github.com/repos/Yoast/google-analytics-for-wordpress/issues/319/comments","events_url":"https://api.github.com/repos/Yoast/google-analytics-for-wordpress/issues/319/events","html_url":"https://github.com/Yoast/google-analytics-for-wordpress/issues/319","id":58501407,"number":319,"title":"Critical Security Vulnerability in Google Analytics by Yoast","user":{"login":"kauth","id":9947191,"avatar_url":"https://avatars.githubusercontent.com/u/9947191?v=3","gravatar_id":"","url":"https://api.github.com/users/kauth","html_url":"https://github.com/kauth","followers_url":"https://api.github.com/users/kauth/followers","following_url":"https://api.github.com/users/kauth/following{/other_user}","gists_url":"https://api.github.com/users/kauth/gists{/gist_id}","starred_url":"https://api.github.com/users/kauth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kauth/subscriptions","organizations_url":"https://api.github.com/users/kauth/orgs","repos_url":"https://api.github.com/users/kauth/repos","events_url":"https://api.github.com/users/kauth/events{/privacy}","received_events_url":"https://api.github.com/users/kauth/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Yoast/google-analytics-for-wordpress/labels/pivotal","name":"pivotal","color":"bfd4f2"}],"state":"closed","locked":false,"assignee":{"login":"Rarst","id":737584,"avatar_url":"https://avatars.githubusercontent.com/u/737584?v=3","gravatar_id":"","url":"https://api.github.com/users/Rarst","html_url":"https://github.com/Rarst","followers_url":"https://api.github.com/users/Rarst/followers","following_url":"https://api.github.com/users/Rarst/following{/other_user}","gists_url":"https://api.github.com/users/Rarst/gists{/gist_id}","starred_url":"https://api.github.com/users/Rarst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rarst/subscriptions","organizations_url":"https://api.github.com/users/Rarst/orgs","repos_url":"https://api.github.com/users/Rarst/repos","events_url":"https://api.github.com/users/Rarst/events{/privacy}","received_events_url":"https://api.github.com/users/Rarst/received_events","type":"User","site_admin":false},"milestone":null,"comments":11,"created_at":"2015-02-22T12:40:16Z","updated_at":"2015-03-05T12:32:13Z","closed_at":"2015-03-05T12:32:13Z","body":"======================================================================\r\nStored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin \r\n======================================================================\r\n\r\n.. contents:: Table Of Content\r\n\r\nOverview\r\n========\r\n\r\n* Title :Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin \r\n* Author: Kaustubh G. Padwad, Rohit Kumar.\r\n* Plugin Homepage: https://yoast.com/wordpress/plugins/google-analytics/\r\n* Severity: Medium\r\n* Version Affected: Version 5.3.2  and mostly prior to it\r\n* Version Tested : Version 5.3.2\r\n* version patched: \r\n\r\nDescription \r\n===========\r\n\r\nVulnerable Parameter  \r\n--------------------\r\n\r\n*  Current UA-Profile\r\n*  Manually enter your UA code\r\n*  Label for those links\r\n*  Set path for internal links to track as outbound links:\r\n*  Subdomain tracking:\r\n*  Extensions of files to track as downloads:\r\n\r\n \t\r\nAbout Vulnerability\r\n-------------------\r\nThis plugin is vulnerable to a Stored Cross Site Scripting vulnerability,This issue was exploited when administrator users with access to \"Google Analytics by Yoast\"  Setting in wordpress above listed vulnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.\r\n\r\nVulnerability Class\r\n===================     \r\nCross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS) \r\n\r\nSteps to Reproduce: (POC)\r\n=========================\r\n\r\nAfter installing the plugin\r\n\r\n* Goto settings --> Google Analytics by Yoast\r\n\r\n* Input this payload in \"Manually enter your UA code\" :-  v style=\"position:absolute;top:0;left:0;width:100%;height:100%\" onmouseover=\"prompt(1)\" onclick=\"alert(1)\">x</button>\r\n* Click on the Save Changes button and navigate your cursor to input box,you will see XSS in action \r\n* Reload the page or re navigate to page to make sure its stored ;)\r\n\r\nMitigation \r\n==========\r\n\r\n\r\nChange Log\r\n==========\r\n\r\n\r\nDisclosure \r\n==========\r\n22-February-2015 reported to developer\r\n\r\ncredits\r\n=======\r\n* Kaustubh Padwad & Rohit Kumar\r\n* Information Security Researcher\r\n* kingkaustubh@me.com & kumarrohit2255@gmail.com\r\n* https://twitter.com/s3curityb3ast\r\n* http://breakthesec.com\r\n* https://www.linkedin.com/in/kaustubhpadwad\r\n"}}