CVE-2023-5774 – Animated Counters – Stored XSS via shortcode (Author+) – POC

When it comes to web application vulnerabilities, Cross-Site Scripting (XSS) is a significant concern. In this article, we’ll delve into CVE-2023-5774, a security flaw that affects the “Animated Counters” plugin. This vulnerability allows for Stored XSS via a shortcode, affecting users with Author-level privileges or higher. We’ll explore the details of this issue and understand the implications, as well as provide recommendations for enhancing security.

Main info:

CVE	CVE-2023-5774
Plugin	Animated Counters
Critical	High
Vulnerable sites	11 070
Publicly Published	October 26, 2023
Last Updated	October 26, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	Will be later
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5774 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/animated-counters/animated-counters-17-authenticated-contributor-stored-cross-site-scripting-via-shortcode
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

CVE-2023-5774 was discovered during the testing of the “Animated Counters” plugin for WordPress. The plugin enables users to create animated counters or progress bars on their websites. However, a security vulnerability was identified during this assessment.

Understanding of Stored XSS attack’s

Stored Cross-Site Scripting (Stored XSS) is a type of XSS attack in which malicious scripts are injected into a web application, and the payload is stored on the server. This payload is then served to other users who access the compromised page. It can have severe consequences as it allows attackers to execute scripts in the context of other users.

In the context of CVE-2023-5774, the vulnerability allows an attacker to embed a malicious script within a shortcode in a new post. The script is stored on the server and executed when other users, particularly those with Author or higher privileges, view the post. This could potentially lead to a full account takeover of the compromised user.

Exploiting

To exploit this vulnerability, an attacker with Author or higher privileges crafts a post containing a specific shortcode with the embedded malicious script. The script payload is stored on the server. When other users, including administrators, view this post, the script is executed in their browsers, allowing the attacker to carry out various malicious actions.

POC shortcode:

[animatedcounter count=”100″ css='” onmouseover=”alert(/XSS/)”‘]

___

The potential risks associated with CVE-2023-5774 are significant. An attacker could gain control over an account with Author or higher privileges. This could lead to various malicious activities, including spreading malware, stealing sensitive information, defacing websites, or compromising the security of the web application.

In real-world scenarios, an attacker may use this vulnerability to compromise websites or web applications that use the “Animated Counters” plugin. They could impersonate users with higher privileges, compromising the integrity and security of the platform.

Recommendations for Improved Security

To enhance security and mitigate the risks associated with this vulnerability, the following measures are recommended:

• Update the Plugin: The first and most crucial step is to ensure the “Animated Counters” plugin is updated to the latest version. Developers often release security patches to address such vulnerabilities.
• User Privilege Management: Review and manage user privileges meticulously. Users, especially those with Author or higher roles, should be granted permissions judiciously.
• Input Validation: Implement input validation and output encoding techniques to prevent XSS attacks. Sanitize user-generated content and validate any input before it is processed or stored.
• Security Audits: Regularly conduct security audits and vulnerability assessments to identify and address potential vulnerabilities proactively.
• Educate Users: Educate users, especially those with administrative roles, about the risks associated with executing shortcodes and how to identify and handle potentially malicious content.

CVE-2023-5774 highlights the importance of vigilant security practices in the development and use of WordPress plugins. Being aware of vulnerabilities, such as Stored XSS via shortcodes, is crucial for maintaining the security and integrity of web applications.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

DMITRII I.