Stored XSS in Bookly WordPress Plugin

Detection Guidance

This vulnerability involves the 'bookly-customer-full-name' cookie being used to inject stored cross-site scripting payloads. Detection involves checking for suspicious or unexpected script content within this specific cookie.

You can inspect HTTP requests and responses to identify if the 'bookly-customer-full-name' cookie contains any malicious script tags or unusual characters.

A simple command to check for the presence of this cookie in HTTP traffic using tcpdump or tshark might be:

• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'bookly-customer-full-name'

Alternatively, if you have access to the web server logs, you can search for occurrences of the 'bookly-customer-full-name' cookie and analyze its values for suspicious script content.

For example, using grep on Apache or Nginx logs:

• grep 'bookly-customer-full-name' /var/log/apache2/access.log | grep -i '<script>'

Note that exploitation requires the 'Remember personal information in cookies' setting to be enabled in the plugin, which is disabled by default.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to execute arbitrary scripts in the context of the affected website. This can lead to theft of user data, session hijacking, defacement of the website, or other malicious actions performed on behalf of the user.

Because the vulnerability is a Stored Cross-Site Scripting issue, the malicious script persists and affects any user who visits the injected page, potentially compromising multiple users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the 'Remember personal information in cookies' setting is disabled, as it is disabled by default and required for exploitation.

Additionally, update the Bookly plugin for WordPress to a version later than 27.2 where this vulnerability is fixed.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the Online Scheduling and Appointment Booking System – Bookly plugin for WordPress, specifically in versions up to and including 27.2. It is a Stored Cross-Site Scripting (XSS) vulnerability that occurs via the 'bookly-customer-full-name' cookie. This happens because the plugin does not properly sanitize input or escape output, allowing attackers to inject malicious web scripts.

When exploited, these injected scripts execute whenever a user accesses a page containing the malicious code. The attack requires the 'Remember personal information in cookies' setting to be enabled, which is disabled by default.

Useful 0 Not Useful 0