# Leaking WordPress CSRF Tokens for Fun, $1337 bounty, and CVE-2017-5489

Author-role user uploads a SWF renamed .jpg (getimagesize accepts SWF), then object-tag forces flash content-type to read same-origin CSRF tokens and create an admin.

- Payout: $1,337
- Severity: high
- Program: WordPress
- Credited: Abdullah Hussam
- Disclosed: 2018-03-15
- CVE: CVE-2017-5489
- Write-up quality: 7/10
- Original: https://ahussam.me/Leaking-WordPress-CSRF-Tokens/
- Library page: https://bugbountylibrary.com/r/blog%3Aahussam-me-leaking-wordpress-csrf-tokens
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:blog sev:high tech:php technique:chained technique:source-review vuln:access-control vuln:csrf vuln:file-upload

**Target:** wp-admin media upload / user-new.php
**Root cause:** wp_check_filetype_and_ext relies on getimagesize(), which accepts SWF magic bytes (CWS), so a Flash file passes image validation; served same-origin it can read pages and exfiltrate nonces.
**Steps:**
1. Compile ActionScript wp_poc.as with mxmlc to wp_poc.swf; it loads a URL from `input` param and calls `ExternalInterface.call("stealtoken", data)`.
2. Rename wp_poc.swf to wp_poc.jpg (magic bytes CWS) and upload via wp-admin/media-new.php as Author.
3. Host steal.html with `<object type="application/x-shockwave-flash" allowscriptaccess="always" data="http://target/wp-content/uploads/2017/10/wp_poc.jpg?input=http://target/wp-admin/user-new.php">`.
4. Flash loads user-new.php same-origin, extracts `_wpnonce_create-user`, calls stealtoken() which redirects to attacker with token.
5. Attacker page renders auto-submitting form POSTing to user-new.php with action=createuser, role=administrator, stolen nonce.
**How found:** Black-box testing of upload as Author role; noticed getimagesize() supports SWF and that MIME comes from request while extension from filename, so renamed SWF passes image checks.
**Exploitation:** Low-privileged Author uploads SWF-as-JPG; victim (admin) visits attacker page; object tag forces application/x-shockwave-flash content-type; Flash reads same-origin admin page, leaks CSRF nonce to attacker, who submits createuser form to add an administrator.
**Escalation:** Chained file-upload bypass + same-origin Flash read + CSRF to escalate Author to full admin takeover.
**Insight:** getimagesize() accepts SWF/SWC magic bytes (CWS/FWS) — any upload validator built on it can be bypassed with a Flash file; combined with an object tag forcing content-type, same-origin reads become possible even from a .jpg.