Reproducing CVE-2025-1489

This repository simulates a reproduction of a web-related CVE (CVE-2025-1489) in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills.

The vulnerability identified and reproduced is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin WP-Appbox (version 4.5.4). The flaw allows attacker-controlled input placed in a post's Appbox shortcode to be rendered into page output due to insufficient input sanitization and output escaping on user-escaped attributes, thus enabling execution of malicious script via attribute contexts. The vulnerability is patched in later versions of WP-Appbox (version 4.5.5+).

Vulnerability Description

The plugin exposes a shortcode [appbox ...] that accepts an applciation ID appID and user-provided shortcode attributes, which are not properly sanitized or escaped at the entry point of the plugin.

In the source code file createoutput.class.php, parts of the shortcode data are inserted into HTML attributes or inline styles, which allows for attribute-context injection (lines 199 & 438-447). By crafting an appID that forces a background image, I was able to confirm repeatable outbound GET requests to an attacker server, which are clear indicators server-side stored XSS.

Components:

• Application: WordPress
• Plugin: WP-Appbox 4.5.4, handles shortcode and HTML generation paths
• Language/Runtime: PHP 8.1, Apache
• Templates: WP-Appbox templates where attribute values are inserted
• Browser: executes injected attribute context on victim's browser

Repository Structure

├── attacker/                
│    ├── server.py            # Attacker HTTP server to serve and log requests
│    └── requests.log         # Logs inbound requests into attacker server from WordPress browser
├── README.md                # Main overview & reproduction instructions
├── docker-compose.yml       # Docker configuration settings
└── full_report.pdf          # Full report including analysis, mitigation, findings, and scope of impact

Steps to Reproduce

Setup:

• Host OS used: MacOS (Linux/Windows also suitable)
• Container platform: Docker Desktop
• Images used: WordPress + MariaDB for application, Attacker container to log inbound requests from WordPress server
• Target plugin: WP-Appbox 4.5.4 installed
• Software versions: WordPress 6.4, PHP 8.1, MariaDB 10.6, Python 3.11, WP-Appbox 4.5.4, Docker Desktop 4.43.2

Prerequisites: Docker Desktop and svn installed on your host.

Steps:

1. Get WP-Appbox plugin: use svn to pull tag 4.5.4:

svn checkout https://plugins.svn.wordpress.org/wp-appbox/tags/4.5.4 wp-appbox-4.5.4

2. Start Docker lab:

docker-compose up -d

3. WordPress setup:

   • Open localhost:8000 to access WordPress and create an Admin user
   • Activate plugin: Navigate to Plugins tab and activate WP-Appbox.
   • Create an attacker user with role privileges of at least Author.

4. Login to attacker user and navigate to Posts > Add New > use Shortcode block to create malicious payload to exploit stored XSS vulnerability.