{"id":7486,"date":"2021-11-30T19:15:17","date_gmt":"2021-12-01T02:15:17","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7486"},"modified":"2023-04-05T12:37:28","modified_gmt":"2023-04-05T19:37:28","slug":"securin-discovers-its-50th-zero-day-vulnerability-in-wordpress-microsoft-clarity-plugin","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securin-discovers-its-50th-zero-day-vulnerability-in-wordpress-microsoft-clarity-plugin\/","title":{"rendered":"Securin (previously CSW) Discovers its 50th Zero Day Vulnerability in WordPress Microsoft Clarity Plugin"},"content":{"rendered":"

Cyber Security Works has discovered a new zero-day (Cross-Site Scripting) vulnerability, CVE-2021-33850 in WordPress Microsoft Clarity. Microsoft Clarity is an open source analytics tool for websites\u00a0 to track how users interact with your website and the most popular pages. This vulnerability was uncovered by CSW researchers on October 17, 2021.<\/p>\n

\n

60% of web applications are susceptible to XSS attacks, which ultimately account for more than 30% of all web application attacks.<\/strong><\/p>\n<\/blockquote>\n

This clearly demonstrates why cybersecurity professionals have high concern when it comes to Cross-Site Scripting (XSS) vulnerabilities. Therefore, CSW researchers were able to find one such vulnerability in Microsoft Clarity version 0.3.<\/p>\n

 <\/p>\n

Description<\/h2>\n

The Microsoft Clarity version 0.3 is vulnerable to a Cross-Site Scripting vulnerability which allows arbitrary code to run in a web browser while the browser is connected to a user’s trusted site. An XSS attack is carried out every time a user changes the clarity configuration in Microsoft Clarity version 0.3 stored on the configuring project ID page.<\/p>\n

This vulnerability has been categorized with a CWE of CWE-79 leading to Improper Neutralization of Input During Web Page Generation. It is notable that CWE-79 has been listed in OWASP Top 10:2021 under A03:2021 \u2013 Injection<\/a> and holds the second place in 2021 CWE Top 25 Most Dangerous Software Weaknesses.<\/a><\/p>\n

Vulnerability at a Glance<\/h2>\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n
\n

\u00a0CVE Number<\/p>\n<\/td>\n

\n

\u00a0CVE-2021-33850<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0Product Name<\/p>\n<\/td>\n

\n

\u00a0Microsoft Clarity version 0.3 WordPress Plugin<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0Affected Version<\/p>\n<\/td>\n

\n

\u00a0Version 0.3<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0Severity<\/p>\n<\/td>\n

\n

\u00a0High<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0Vendor<\/p>\n<\/td>\n

\n

\u00a0Microsoft<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0CWE<\/p>\n<\/td>\n

\n

\u00a0CWE-79 (Improper Neutralization of Input During Web Page Generation)<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0CVSS Vector<\/p>\n<\/td>\n

\n

\u00a0CVSS:3.0\/AV:N\/AC:L\/PR:H\/UI:R\/S:U\/C:N\/I:H\/A:N<\/p>\n<\/td>\n<\/tr>\n

\n

\u00a0CVSS V3 Score<\/p>\n<\/td>\n

\n

\u00a04.9<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Timeline<\/h2>\n

\"\"<\/p>\n

Proof-of-Concept<\/h2>\n

The following vulnerability was detected in WordPress Microsoft Clarity Plugin version 0.3.<\/p>\n

Issue:<\/strong> Cross-Site Scripting<\/p>\n

Severity:<\/strong> Medium<\/p>\n

    \n
  1. \n

    Log in to the WordPress application.<\/p>\n<\/li>\n

  2. \n

    Install Microsoft Clarity plugin to your WordPress application.<\/p>\n<\/li>\n<\/ol>\n

    <\/p>\n

    Figure 1: <\/strong>Microsoft Clarity Plugin Installation<\/p>\n

      \n
    1. \n

      Click on Settings, and the Clarity Setting page appears.<\/p>\n<\/li>\n<\/ol>\n

      <\/p>\n

      Figure 2: <\/strong>Microsoft Clarity Settings Page<\/p>\n

        \n
      1. \n

        In the Clarity Settings page, enter the payload in the \u2018project ID\u2019 section (clarity_project_id parameter).<\/p>\n<\/li>\n<\/ol>\n

        <\/p>\n

        Figure 3:<\/strong> Entering Encoded XSS Payload in the Project ID section<\/p>\n

          \n
        1. \n

          Injected XSS payload gets executed whenever the user changes the clarity configuration page.<\/p>\n<\/li>\n<\/ol>\n

          <\/p>\n

          Figure 4:<\/strong> Injected XSS Payload Executed and Displays an Alert Box<\/p>\n

          Impact<\/h2>\n

          An attacker can control a script executed in the victim’s browser and fully compromise the targeted user. In addition, an XSS vulnerability enables attacks that are contained within the application itself. There is no need to find an external way of inducing the victim to make a request containing their exploit. Instead, the attacker places the exploit inside the application itself and simply waits for users to encounter it, thus, resulting in the following\u2014<\/p>\n