Reflected XSS in Spam protection, AntiSpam, FireWall by CleanTalk

Update – after this article was published, Denis Shagimuratov of CleanTalk reached out to us on Twitter. It appears that they didn’t receive our disclosure because our contact at the company was no longer the correct recipient for this type of issue.

On February 15, 2022, the Wordfence Threat Intelligence team finished research on two separate vulnerabilities in Spam protection, AntiSpam, FireWall by CleanTalk, a WordPress plugin with over 100,000 installations. These were both reflected Cross-Site scripting vulnerabilities which could be used for site takeover if an attacker could successfully trick a site administrator into performing an action, such as clicking a link.

We initially attempted to contact CleanTalk the same day via a method that we had previously used to successfully report vulnerabilities. After we did not receive a response for over a month, we contacted the WordPress plugins team on March 22, 2022. A patched version, 5.174.1, was made available on March 25, 2022.

All Wordfence customers, including Wordfence Premium, Wordfence Care, and Wordfence Response customers as well as Wordfence free users, are protected against any exploits targeting these vulnerabilities by the Wordfence firewall’s built-in Cross-Site Scripting protection.

CleanTalk is a WordPress plugin designed to protect websites from spam comments and registrations. One of the features it includes is the ability to check comments for spam and present the spammy comments for deletion.
The plugin uses the column_ct_comment function in /lib/Cleantalk/ApbctWP/FindSpam/ListTable/Comments.php to display the list of spam comments, and in doing so generates links to approve, trash, or mark comments as spam using the value supplied in $_REQUEST[‘page’].

Thanks to a quirk of how WordPress processes the page parameter and the default PHP request order, it is possible to use this parameter to perform a reflected cross-site scripting attack, which is almost identical to a vulnerability we recently covered.

The vulnerability can be used to execute JavaScript in the browser of a logged-in administrator, for instance, by tricking them into visiting a self-submitting form that sends a POST request to the site at wp-admin/edit-comments.php?page=ct_check_spam, with the $_POST[‘page’] parameter set to malicious JavaScript.

As with any Cross-Site Scripting vulnerability, executing JavaScript in an administrator’s session can be used to take over a site by adding a new malicious administrator or injecting a backdoor, among other potential methods.

Similar to the spam comment functionality, CleanTalk also includes a feature that checks for spammy users and presents them in a similar table for review and deletion. In this case the vulnerable function is column_ct_username in /lib/Cleantalk/ApbctWP/FindSpam/ListTable/Users.php, which uses the value of $_REQUEST[‘page’] to generate links to delete potentially spammy users. As with the spam comment vulnerability, if an administrator can be tricked into performing an action, it is possible to use JavaScript running in their browser to take over a site.

Timeline

February 15, 2022 – The Wordfence Threat Intelligence team finishes our investigation and verifies that the Wordfence firewall’s built-in protection is sufficient to block exploit attempts. We send the full disclosure to a contact at CleanTalk that we have successfully disclosed vulnerabilities to in the past.
March 22, 2022 – As we have not yet heard back from our contact, we reported the vulnerability to the WordPress plugins team.
March 25, 2022 – A patched version of the plugin, 5.174.1, becomes available.

Conclusion

In today’s article, we covered two nearly identical reflected Cross-Site Scripting vulnerabilities in the Spam protection, AntiSpam, FireWall by CleanTalk plugin for WordPress. While both of these vulnerabilities require some degree of social engineering, both could be used for site takeover.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites still running the free version of Wordfence, are fully protected against this vulnerability.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

If you know a friend or colleague who is using this plugin on their site, we highly recommend forwarding this advisory to them to help keep their sites protected, as this is a serious vulnerability that can lead to complete site takeover.

This article was written by Ramuel Gall, a former Wordfence Senior Security Researcher.