Users of the Advanced Custom Fields plugin for WordPress are urged to update to version 6.1.6 following the discovery of a security vulnerability.
Vấn đề, được gán mã định danh CVE-2023-30777, liên quan đến một trường hợp tập lệnh chéo trang web được phản ánh (XSS) có thể bị lạm dụng để đưa các tập lệnh thực thi tùy ý vào các trang web lành tính khác.
The plugin, available in both free and professional editions, has more thantwo million active installations. The issue was found and reported to the maintainers in February 2023.
“Lỗ hổng này cho phép bất kỳ người dùng chưa được authentication nào đánh cắp thông tin nhạy cảm, trong trường hợp này, leo thang đặc quyền trên trang web WordPress bằng cách lừa người dùng đặc quyền truy cập đường dẫn URL được tạo ra”, nhà nghiên cứu Rafie Muhammad của Patchstack cho biết.
AttacksXSSreflected typically occurs when a victim is tricked into clicking a bogus link delivered by email or another route, causing malicious code to be sent to the vulnerable website, which reflects the attack back into the user’s browser.
This social-engineering element means that reflected XSS does not have the same reach and scale as stored XSS attacks, which pushes threat actors to distribute malicious links to as many victims as possible.
“[A reflected XSS attack] is usually the result of incoming requests not being sufficiently sanitized, which allows a web application’s functions to be manipulated and malicious scripts to be triggered,” Imperva notes.
It should be noted that CVE-2023-30777 can be triggered on a default installation or configuration of Advanced Custom Fields, although only by a logged-in user who has access to the plugin.
This comes as Craft CMS patched two medium-severity XSS vulnerabilities (CVE-2023-30177 andCVE-2023-31144) could be exploited by threat actors to deliver a malicious payload.
It also follows the disclosure of another XSS vulnerability in the cPanel product (CVE-2023-29489, CVSS score: 6.1) can be exploited without any authentication to run arbitrary JavaScript.
“An attacker could target not only cPanel's management ports but also applications running on ports 80 and 443,” added Shubham Shah of Assetnote, noting that it could allow an adversary to hijack a legitimate user's cPanel session.
“Once an action can be performed on behalf of an authenticated cPanel user, uploading a web shell and executing commands is usually trivial.”
