WordPress Page Builder KingComposer <=2.9.6 - Open Redirect

mediumseverity

6.1CVSS score

4.3%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

WordPress Page Builder KingComposer 2.9.6 and prior does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action (which is available to both unauthenticated and authenticated users).

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the execution of further attacks.

Fix

Update to the latest version of KingComposer (>=2.9.7) to fix the open redirect vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=kc_get_thumbn&id=https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2022-0165 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-0165

info:
  name: WordPress Page Builder KingComposer <=2.9.6 - Open Redirect
  author: akincibor
  severity: medium
  description: WordPress Page Builder KingComposer 2.9.6 and prior does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action (which is available to both unauthenticated and authenticated users).
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the execution of further attacks.
  remediation: |
    Update to the latest version of KingComposer (>=2.9.7) to fix the open redirect vulnerability.
  reference:
    - https://wpscan.com/vulnerability/906d0c31-370e-46b4-af1f-e52fbddd00cb
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0165
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/K3ysTr0K3R/CVE-2022-0165-EXPLOIT
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0165
    cwe-id: CWE-601
    epss-score: 0.0428
    epss-percentile: 0.91184
    cpe: cpe:2.3:a:king-theme:kingcomposer:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: king-theme
    product: kingcomposer
    framework: wordpress
  tags: cve,cve2022,wp-plugin,redirect,wordpress,wp,wpscan,king-theme,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=kc_get_thumbn&id=https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

References

Use this check only on systems you are authorised to test. Where the data comes from