WordPress eCommerce Music Store Open Redirect Scanner

The WordPress eCommerce Music Store Plugin is a plugin often integrated into WordPress websites that need to manage and sell music-based content. It is widely utilized by digital music retailers, independent musicians, and music producers who sell their tracks online through WordPress-based websites. The plugin supports digital downloads and provides an online music store experience. Users appreciate it for the flexibility it offers in downloading files of various audio formats. Furthermore, the plugin is praised for its ease of integration with WordPress's robust platform, making it accessible even for users with minimal technical experience. As a market choice, it offers custom themes and widgets, along with other essential e-commerce functionalities.

The open redirect vulnerability occurs when a web application improperly processes user-supplied input to construct a URL that leads users to untrusted sites. This specific vulnerability found in the WordPress eCommerce Music Store Plugin arises through the 'referer' header, allowing hackers to redirect users to external malicious sites. Such redirects may facilitate phishing attacks, potentially tricking users into providing sensitive information. If an attacker exploits this vulnerability, they may lead unsuspecting users to host sites tailored for malware installations. This might induce actions like information theft, unauthorized operations, or end-user disruption. Preventing such attacks involves implementing strict validation of URLs and redirection pathways.

For the technically inclined, the vulnerable parameter in this plugin is the 'referer' header. A malicious actor can exploit this by crafting links that manipulate the header to direct users to unintended destinations. The endpoint ms-core/ms-submit.php in the plugin is vulnerable due to inadequate validation, enabling such unwelcome redirects. The lack of input sanitization results in the application interpreting crafted URLs as legitimate, fueling a redirect sequence. Hackers typically use redirect chains to notarize credible by-passing, leveraging this flaw to incorporate harmful final destinations. URL encoding and double encoding are often avenues manipulated within this vector to bypass initial security checks.

Once fully exploited, this open redirect vulnerability could lead users to phishing sites, mirroring legitimate services demanding sensitive credentials. Moreover, it acts as a stepping stone to more advanced attacks by scouting potential vulnerabilities in redirected domains. Besides phishing, it can bring users to sites embedded with malware, triggering system infections without direct downloads. Such actions not only compromise information integrity but also lead to significant trust and reputation damage for the affected site. Compromised systems might serve as pivots for further network intrusions or unauthorized use of resources, imposing financial and operational repercussions.

REFERENCES

• https://wpscan.com/vulnerability/d73f6575-eb86-480c-bde1-f8765870cdd1
• https://seclists.org/fulldisclosure/2015/Jul/113