bugtraq - Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Key and Token

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAD-LzdRtm9A4j4ujgUeQ8C8FL6ZrqSBKJFnEPLZitB=WtosxtA@mail.gmail.com>
Date: Fri, 26 May 2017 12:49:27 -0700
From: kyle Lovett <krlovett@...il.com>
To: bugtraq@...urityfocus.com
Subject: Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Key
 and Token

Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Keys
CWE-522 :Insufficiently Protected Credentials

Products:
Wordpress Social Stream
Versions 1.6.0 and lower
https://codecanyon.net/item/wordpress-social-stream/2201708

Social Network Tabs
Versions 1.7.4 and lower
https://codecanyon.net/item/social-network-tabs-for-wordpress/1982987

Fix:
Wordpress Social Stream, V 1.6.1
https://codecanyon.net/item/wordpress-social-stream/2201708

"WordPress Social Stream will combine all of your social network feeds into one
single network stream or create a single feed for multiple social
network profiles."

A weakness exists in the Wordpress plugin Social-Stream which exposes all four
Twitter API keys as parameters of a URL link on the webpage in which
the plugin widget
is rendered.

consumer_key
consumer_secret
oauth_access_token
oauth_access_token_secret

When the end user places the code in their HTML to embed a Twitter Stream feed,
it calls the file dcwp_twitter.php, where the Twitter API keys are stored.
Those keys are set as a variable, then are incorrectly echo'd onto the webpage.

===============================================================================
$auth = new dcwss_TwitterOAuth($consumer_key,$consumer_secret,$oauth_access_token,$oauth_access_token_secret);
$get = $auth->get( $rest, $params );
//print_r($get->errors);
} else {
echo $get;
}
===============================================================================

The full and clear text URL is exposed similar to this:

http://example.com/wp-content/plugins/wordpress-social-stream/inc/dcwp_twitter.php?1=consumer_key&2=consumer_secret&3=access_key&4=access_secret

Google Dork
https://www.google.com/search?num=100&q=dcwp_twitter+text&filter=0

Fix:
The vendor has issued a patch for the Wordpress Social Stream, V 1.6.1
available here:
https://codecanyon.net/item/wordpress-social-stream/2201708

It is not known whether a patch has been issued for Social Network Tabs plugin.

An important note, the keys will remain good even after the patch,
until the end user revokes the original keys and issues a new set.
Changing one's password will not mitigate this problem, however
setting the app to be read only in Twitter will mitigate an attackers
ability to post tweets or change profile pictures as them.
------------------------------------------------------------------------------
Timeline:
Vendor notified on 04/01/2017
Fix Complete on 04/06/2017
Disclosure Public 05/21/2017
Contact: Kyle Lovett krlovett@...il.com
------------------------------------------------------------------------------