RCE Security Advisory
\nhttps:\/\/www.rcesecurity.com<\/p>\n
1. ADVISORY INFORMATION
\n=======================
\nProduct: Transposh WordPress Translation
\nVendor URL: https:\/\/wordpress.org\/plugins\/transposh-translation-filter-for-wordpress\/
\nType: Cross-Site Scripting [CWE-79]\nDate found: 2021-08-19
\nDate published: 2022-07-22
\nCVSSv3 Score: 4.7 (CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:N\/I:L\/A:N)
\nCVE: CVE-2021-24910<\/p>\n
2. CREDITS
\n==========
\nThis vulnerability was discovered and researched by Julien Ahrens from
\nRCE Security.<\/p>\n
3. VERSIONS AFFECTED
\n====================
\nTransposh WordPress Translation 1.0.7 and below<\/p>\n
4. INTRODUCTION
\n===============
\nTransposh translation filter for WordPress offers a unique approach to blog
\ntranslation. It allows your blog to combine automatic translation with human
\ntranslation aided by your users with an easy to use in-context interface.<\/p>\n
(from the vendor’s homepage)<\/p>\n
5. VULNERABILITY DETAILS
\n========================
\nThe plugin’s ajax action “tp_tp” is vulnerable to an unauthenticated\/authenticated
\nreflected Cross-Site Scripting vulnerability when user-supplied input to the HTTP
\nGET parameter “q” is processed by the web application. Since the application does
\nnot properly validate and sanitize this parameter, it is possible to place
\narbitrary script code onto the same page.<\/p>\n
This offers a wide range of possible attacks such as redirecting the user to a
\nmalicious page, spoofing content on the page or attacking the browser and its
\nplugins. Since all session-relevant cookies are protected by HTTPOnly, it is not
\npossible to hijack sessions.<\/p>\n
6. PROOF OF CONCEPT
\n===================
\nThe following PoC triggers a JavaScript alert:<\/p>\n
http:\/\/[host]\/wp-admin\/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=<img%20src%3dx%20onerror%3dalert(document.cookie)><\/p>\n
7. SOLUTION
\n===========
\nUpdate to Transposh 1.0.8.1<\/p>\n
8. REPORT TIMELINE
\n==================
\n2021-08-19: Discovery of the vulnerability
\n2021-08-20: Contacted the vendor via their contact form
\n2021-08-20: Vendor response
\n2021-08-20: Sent all the PoC exploits
\n2021-08-20: Vendor acknowledges the issues
\n2021-09-14: Requested status update from vendor
\n2021-10-07: No response from vendor, requested status update again
\n2021-10-25: CVE requested from WPScan (CNA)
\n2021-10-27: WPScan assigns CVE-2021-24910
\n2022-02-22: Vendor releases 1.0.8 which fixes this vulnerability
\n2022-07-22: Public disclosure<\/p>\n
9. REFERENCES
\n=============
\nhttps:\/\/github.com\/MrTuxracer\/advisories
\nhttps:\/\/transposh.org\/version-1-0-8-thanks-julien\/<\/p>\n","protected":false},"excerpt":{"rendered":"
RCE Security Advisory https:\/\/www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https:\/\/wordpress.org\/plugins\/transposh-translation-filter-for-wordpress\/ Type: Cross-Site Scripting [CWE-79] Date found: 2021-08-19 Date published: 2022-07-22 CVSSv3 Score: 4.7 (CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:N\/I:L\/A:N) CVE: CVE-2021-24910 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== Transposh WordPress Translation 1.0.7 and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28586","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28586"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28586\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}