Authenticated Stored XSS in WooCommerce and Jetpack Plugin

This blog post is about the WooCommerce and Jetpack plugin vulnerability. If you’re a WooCommerce and Jetpack user, please update the plugin to at least version 8.2.0 and 12.8-a.3 respectively.

For plugin developers, we have security audit services and Threat Intelligence Feed API for hosting companies.

About the WooCommerce and Jetpack plugin

The plugin WooCommerce (versions <= 8.1.1, free version), which has over 5 million active installations, is known as the most popular open-source eCommerce solution in WordPress. The other plugin Jetpack (versions <= 12.8-a.1, free version) also has over 5 million active installations and is known as the most installed security, performance, marketing, and design tools plugin in WordPress. Both plugins are developed by Automattic.

WooCommerce plugin is commonly used to create online e-commerce shops. With this plugin, anyone can turn their regular website into a fully functioning online store, complete with all the necessary e-commerce features. WooCommerce also allows users to manage their online stores easily. From setting up product displays, and managing orders, to accepting multiple payment gateways.

For the Jetpack plugin, it provides security, performance, and growth tools for WordPress sites. This plugin offers several features such as a site activity log, daily backups, spam prevention tools, etc.

The security vulnerability

Both of the plugins suffer from an authenticated cross-site scripting (XSS) vulnerability. It allows a user with a minimum user role of Contributor to inject arbitrary JavaScript code into the website and could result from stealing sensitive information to, in this case, privilege escalation on the WordPress site.

This vulnerability occurs because there is a lack of output escaping and sanitization on the registered Gutenberg blocks. Gutenberg blocks itself allow us to build our own custom posts and pages without any additional custom code. The described vulnerability was fixed in WooCommerce version 8.2.0 and Jetpack version 12.8-a.3. The vulnerability on the WooCommerce and Jetpack plugins have been assigned CVE-2023-47777 and CVE-2023-45050 respectively.

WooCommerce Contributor+ Cross-Site Scripting (XSS)

We found the vulnerability in multiple areas of the code that handle the custom Gutenberg block process. The vulnerable code specifically exists in the block attributes parameter that could be supplied by the user with a Contributor role when constructing a custom block. The vulnerability itself originally existed on the WooCommerce Blocks component which also exists as a standalone plugin.

The first vulnerable case is from wp:woocommerce/featured-product block and located on render_image and render_bg_image function:

private function render_image( $attributes, $item, string $image_url ) {
    $style = sprintf( 'object-fit: %s;', $attributes['imageFit'] );

    if ( $this->hasFocalPoint( $attributes ) ) {
        $style .= sprintf(
            'object-position: %s%% %s%%;',
            $attributes['focalPoint']['x'] * 100,
            $attributes['focalPoint']['y'] * 100
        );
    }

    if ( ! empty( $image_url ) ) {
        return sprintf(
            '',
            wp_kses_post( $attributes['alt'] ?: $this->get_item_title( $item ) ),
            $this->block_name,
            $image_url,
            $style
        );
    }

    return '';
}

private function render_bg_image( $attributes, $image_url ) {
    $styles = $this->get_bg_styles( $attributes, $image_url );

    $classes = [ "wc-block-{$this->block_name}__background-image" ];

    if ( $attributes['hasParallax'] ) {
        $classes[] = ' has-parallax';
    }

    return sprintf( '
', implode( ' ', $classes ), $styles );
}

The affected variable on render_image function is $attributes['alt'] and $style. These block attributes are not properly sanitized. The usage of wp_kses_post on the $attributes['alt'] also cannot prevent the double quotes from breaking out from the image alt attribute. For the render_bg_image function, the vulnerable variable is on $styles.

The second vulnerable case comes from wp:woocommerce/mini-cart block. The vulnerable block attributes exist on get_markup, get_cart_price_markup, and get_include_tax_label_markup function. First, let’s view the get_markup function :

protected function get_markup( $attributes ) {
    if ( is_admin() || WC()->is_rest_api_request() ) {
        // In the editor we will display the placeholder, so no need to load
        // real cart data and to print the markup.
        return '';
    }

    $classes_styles  = StyleAttributesUtils::get_classes_and_styles_by_attributes( $attributes, array( 'text_color', 'background_color', 'font_size', 'font_weight', 'font_family' ) );
    $wrapper_classes = sprintf( 'wc-block-mini-cart wp-block-woocommerce-mini-cart %s', $classes_styles['classes'] );
    if ( ! empty( $attributes['className'] ) ) {
        $wrapper_classes .= ' ' . $attributes['className'];
    }
    $wrapper_styles = $classes_styles['styles'];

    $icon_color          = array_key_exists( 'iconColor', $attributes ) ? $attributes['iconColor']['color'] : 'currentColor';
    $product_count_color = array_key_exists( 'productCountColor', $attributes ) ? $attributes['productCountColor']['color'] : '';

    // Default "Cart" icon.
    $icon = '';

    if ( isset( $attributes['miniCartIcon'] ) ) {
        if ( 'bag' === $attributes['miniCartIcon'] ) {
            $icon = '';
        } elseif ( 'bag-alt' === $attributes['miniCartIcon'] ) {
            $icon = '';
        }
    }

    $button_html = $this->get_cart_price_markup( $attributes ) . '
    
        ' . $icon . '
        
    ';

    if ( is_cart() || is_checkout() ) {
        if ( $this->should_not_render_mini_cart( $attributes ) ) {
            return '';
        }

        // It is not necessary to load the Mini-Cart Block on Cart and Checkout page.
        return '

            ' . $button_html . '
        
';
    }
----------------------- CUTTED HERE -----------------------

Notice that the vulnerable variable located on $icon_color, $product_count_color and $wrapper_classes which all come from block attributes and are not properly sanitized before concatenated as HTML value.

Let’s view the get_cart_price_markup and get_include_tax_label_markup function:

/**
 * Returns the markup for the cart price.
 *
 * @param array $attributes Block attributes.
 *
 * @return string
 */
protected function get_cart_price_markup( $attributes ) {
    if ( isset( $attributes['hasHiddenPrice'] ) && false !== $attributes['hasHiddenPrice'] ) {
        return;
    }
    $price_color = array_key_exists( 'priceColor', $attributes ) ? $attributes['priceColor']['color'] : '';

    return '' . $this->get_include_tax_label_markup( $attributes );
}

/**
 * Returns the markup for render the tax label.
 *
 * @param array $attributes Block attributes.
 *
 * @return string
 */
protected function get_include_tax_label_markup( $attributes ) {
    if ( empty( $this->tax_label ) ) {
        return '';
    }
    $price_color = array_key_exists( 'priceColor', $attributes ) ? $attributes['priceColor']['color'] : '';

    return '';
}

The vulnerable variable on those two functions is the same, which comes from $price_color variable constructed from $attributes['priceColor']['color'].

The third vulnerable case is on wp:woocommerce/product-image block and exist on render_on_sale_badge function :

private function render_on_sale_badge( $product, $attributes ) {
    if ( ! $product->is_on_sale() || false === $attributes['showSaleBadge'] ) {
        return '';
    }

    $font_size = StyleAttributesUtils::get_font_size_class_and_style( $attributes );

    $on_sale_badge = sprintf(
        '
        

            %s
            Product on sale
        
        ',
        $attributes['saleBadgeAlign'],
        isset( $font_size['class'] ) ? esc_attr( $font_size['class'] ) : '',
        isset( $font_size['style'] ) ? esc_attr( $font_size['style'] ) : '',
        esc_html__( 'Sale', 'woocommerce' )
    );
    return $on_sale_badge;
}

The vulnerable variable is located on $attributes['saleBadgeAlign'] where it is directly concatenated inside of the div class attribute without proper escaping.

The fourth and last vulnerable case exists on wp:woocommerce/product-results-count block, specifically on render function:

protected function render( $attributes, $content, $block ) {
    ob_start();
    woocommerce_result_count();
    $product_results_count = ob_get_clean();

    $classes_and_styles = StyleAttributesUtils::get_classes_and_styles_by_attributes( $attributes );
    $classname          = isset( $attributes['className'] ) ? $attributes['className'] : '';

    return sprintf(
        '
%4$s
',
        esc_attr( $classes_and_styles['classes'] ),
        $classname,
        esc_attr( $classes_and_styles['styles'] ),
        $product_results_count
    );
}

The vulnerable parameter on this function is located on $classname which come from $attributes['className'] value.

Jetpack Contributor+ Cross-Site Scripting (XSS)

We also found several vulnerable cases on the custom Gutenberg blocks. The first vulnerable case exists on wp:jetpack/button block specifically on render_block function:

function render_block( $attributes, $content ) {
	$save_in_post_content = get_attribute( $attributes, 'saveInPostContent' );

	// The Jetpack Button block depends on the core button block styles.
	// The following ensures that those styles are enqueued when rendering this block.
	enqueue_existing_button_style_dependency( 'core/button' );
	enqueue_existing_button_style_dependency( 'core/buttons' );

	Jetpack_Gutenberg::load_styles_as_required( FEATURE_NAME );

	if ( $save_in_post_content || ! class_exists( 'DOMDocument' ) ) {
		return $content;
	}

	$element   = get_attribute( $attributes, 'element' );
	$text      = get_attribute( $attributes, 'text' );
	$unique_id = get_attribute( $attributes, 'uniqueId' );
	$url       = get_attribute( $attributes, 'url' );
	$classes   = Blocks::classes( FEATURE_NAME, $attributes, array( 'wp-block-button' ) );

	$button_classes = get_button_classes( $attributes );
	$button_styles  = get_button_styles( $attributes );
	$wrapper_styles = get_button_wrapper_styles( $attributes );

	$wrapper_attributes = sprintf( ' class="%s" style="%s"', esc_attr( $classes ), esc_attr( $wrapper_styles ) );
	$button_attributes  = sprintf( ' class="%s" style="%s"', esc_attr( $button_classes ), esc_attr( $button_styles ) );

	if ( empty( $unique_id ) ) {
		$button_attributes .= ' data-id-attr="placeholder"';
	} else {
		$button_attributes .= sprintf( ' data-id-attr="%1$s" id="%1$s"', esc_attr( $unique_id ) );
	}

	if ( 'a' === $element ) {
		$button_attributes .= sprintf( ' href="%s" target="_blank" role="button" rel="noopener noreferrer"', esc_url( $url ) );
	} elseif ( 'button' === $element ) {
		$button_attributes .= ' type="submit"';
	} elseif ( 'input' === $element ) {
		$button_attributes .= sprintf( ' type="submit" value="%s"', wp_strip_all_tags( $text, true ) );
	}

	$button = 'input' === $element
		? '<' . $element . $button_attributes . ' />'
		: '<' . $element . $button_attributes . '>' . $text . '';

	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	return '' . $button . '

public function deprecated_render_button_v1( $attrs, $plan_id ) {
    $button_label = isset( $attrs['submitButtonText'] )
        ? $attrs['submitButtonText']
        : __( 'Your contribution', 'jetpack' );

    $button_styles = array();
    if ( ! empty( $attrs['customBackgroundButtonColor'] ) ) {
        array_push(
            $button_styles,
            sprintf(
                'background-color: %s',
                sanitize_hex_color( $attrs['customBackgroundButtonColor'] )
            )
        );
    }
    if ( ! empty( $attrs['customTextButtonColor'] ) ) {
        array_push(
            $button_styles,
            sprintf(
                'color: %s',
                sanitize_hex_color( $attrs['customTextButtonColor'] )
            )
        );
    }
    $button_styles = implode( ';', $button_styles );

    return sprintf(
        '
%5$s
',
        esc_attr(
            Blocks::classes(
                self::$button_block_name,
                $attrs,
                array( 'wp-block-button' )
            )
        ),
        esc_url( $this->get_subscription_url( $plan_id ) ),
        isset( $attrs['submitButtonClasses'] ) ? esc_attr( $attrs['submitButtonClasses'] ) : 'wp-block-button__link',
        esc_attr( $button_styles ),
        wp_kses( $button_label, self::$tags_allowed_in_the_button ),
        isset( $attrs['submitButtonAttributes'] ) ? sanitize_text_field( $attrs['submitButtonAttributes'] ) : '' // Needed for arbitrary target=_blank on WPCOM VIP.
    );
}

function render_video( $media ) {
	if ( empty( $media['id'] ) || empty( $media['mime'] ) || empty( $media['url'] ) ) {
		return __( 'Error retrieving media', 'jetpack' );
	}

	if ( ! empty( $media['poster'] ) ) {
		return render_image(
			array_merge(
				$media,
				array(
					'type' => 'image',
					'url'  => $media['poster'],
				)
			)
		);
	}

	return sprintf(
		'',
		esc_attr( get_the_title( $media['id'] ) ),
		esc_attr( $media['mime'] ),
		$media['id'],
		esc_attr( $media['url'] )
	);
}

public static function render_videopress_video_block( $block_attributes, $content ) {
    global $wp_embed;

    // CSS classes
    $align        = isset( $block_attributes['align'] ) ? $block_attributes['align'] : null;
    $align_class  = $align ? ' align' . $align : '';
    $custom_class = isset( $block_attributes['className'] ) ? ' ' . $block_attributes['className'] : '';
    $classes      = 'wp-block-jetpack-videopress jetpack-videopress-player' . $custom_class . $align_class;

    // Inline style
    $style     = '';
    $max_width = isset( $block_attributes['maxWidth'] ) ? $block_attributes['maxWidth'] : null;
    if ( $max_width && $max_width !== '100%' ) {
        $style = sprintf( 'max-width: %s; margin: auto;', $max_width );
    }

    /*
     *