They also point out the possible negligence in reviewing WordPress plugins and question the scope of these bugs under their bug bounty program.
Since they are both vulnerabilities in the type of code that is often involved in disclosed WordPress plugin vulnerabilities, those vulnerabilities should not have been missed if security reviews of the plugins were done… So, it seems highly unlikely that Facebook got that done with the plugins. Instead… Facebook has a bug bounty program. It isn’t clear if these plugins would fall under that or what they would even pay out any bounty.Well, we are not really delving into the debate of whether they are right or wrong in their practice. So, let us quickly review the vulnerabilities they discovered.
Specifically, the security firm found bugs in the ‘Facebook for WooCommerce’ plugin and ‘Messenger Customer Chat’ plugin. The former plugin currently has over 200,000 active installations. Whereas, the later has more than 20,000.
Out of curiosity, the researchers began analyzing the plugin and came up with a cross-site request forgery (CSRF) vulnerability. They found a lacking of a nonce to prevent CSRF with the AJAX function ajax_update_fb_option(). They have shared a proof of concept in their report.
Following this discovery, the researchers quickly analyzed another plugin and found a similar problem with ‘Messenger Customer Chat’ too. As stated in their report, they found another CSRF vulnerability, for which they have shared the PoC as well.
Both the vulnerabilities, upon exploit, can allow a potential attacker to alter WordPress site options. While they may not be as dangerous as other web application vulnerabilities, their public disclosures demand an immediate fix to avoid potential threats to the users of the respective plugins.
Let us know your thoughts in the comments.
