Please visit my blog : http://localhost:6060

Wordpress owner (admin or editor role needed).

1. login in the wordpress "backend" by going to http://localhost/wp-admin log : wordpress password : wordpress
2. You should see a comment to validate in the comment section, just click on the link.
3. Go back to http://localhost/wp-admin : click on the comment tab, you should have a new comment already validted without any action from your side...

Limitiation :

1. the malicious code in the iframe only works with the post ID=1 (Hello World!)
2. if a "hacked" comment is already validated, it does not work again
3. nonce protection seems not to be needed to make a comment validation (in other tutorial, it is needed because -maybe - you want to use a plugin / theme action ?)
4. As already said : to demonstrate the full potential of CVE-2019-9787 you probably want a more nasty piece of code than the comment present in nginx/iframe-post.html. In my code I don't use the flaw in the Wordpress wp_filter_post_kses().

uninstall / retry / refresh :

To stop service

docker-compose down

To delete all containers including its volumes use

docker rm -vf $(docker ps -a -q)

To delete all the images

docker rmi -f $(docker images -a -q)

Don't forget to delete the repository

cd .. sudo sudo rm -Rf Wordpress_CVE_2019-9787

Intial project copied/forked to make this happened :

For the wordpress auto install : https://github.com/kassambara/wordpress-docker-compose

For the CVE proof of concept (without a autoinstall wordpress) : https://github.com/rkatogit/cve-2019-9787_csrf_poc

If there is any (official) way to link those pages to this one please let me know, I use the fork on the second one but without knowing really what I was doing :-)