PT-2017-14997 · Clockwork · Two-Factor Authentication - Clockwork Sms+7

Published 2017-12-20 · Updated 2021-03-11 · CVE-2017-17780

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Clockwork Free and Paid SMS Notifications versions 2.0.3 Two-Factor Authentication - Clockwork SMS version 1.0.2 Booking Calendar - Clockwork SMS version 1.0.5 Contact Form 7 - Clockwork SMS version 2.3.0 Fast Secure Contact Form - Clockwork SMS version 2.1.2 Formidable - Clockwork SMS version 1.0.2 Gravity Forms - Clockwork SMS version 2.2 WP e-Commerce - Clockwork SMS version 2.0.5

Description The issue is related to a crafted "to" parameter in a clockwork-test-message request to "wp-admin/admin.php", which leads to XSS. This affects various WordPress plugins that use the Clockwork SMS component.

Recommendations For Clockwork Free and Paid SMS Notifications version 2.0.3, update to a version that fixes the issue. For Two-Factor Authentication - Clockwork SMS version 1.0.2, update to a version that fixes the issue. For Booking Calendar - Clockwork SMS version 1.0.5, update to a version that fixes the issue. For Contact Form 7 - Clockwork SMS version 2.3.0, update to a version that fixes the issue. For Fast Secure Contact Form - Clockwork SMS version 2.1.2, update to a version that fixes the issue. For Formidable - Clockwork SMS version 1.0.2, update to a version that fixes the issue. For Gravity Forms - Clockwork SMS version 2.2, update to a version that fixes the issue. For WP e-Commerce - Clockwork SMS version 2.0.5, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin.php" endpoint to minimize the risk of exploitation. Avoid using the to parameter in the affected clockwork-test-message request until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-17780

Affected Products

Booking Calendar - Clockwork Sms

Clockwork Free/Paid Sms Notifications

Contact Form 7 - Clockwork Sms

Fast Secure Contact Form - Clockwork Sms

Formidable - Clockwork Sms

Gravity Forms - Clockwork Sms

Two-Factor Authentication - Clockwork Sms

Wp E-Commerce - Clockwork Sms

References · 4

• 🔥 https://packetstormsecurity.com/files/145469/Clockwork-SMS-Cross-Site-Scripting.html · Exploit
• https://plugins.trac.wordpress.org/changeset/1781424/clockwork-two-factor-authentication/trunk/templates/clockwork-test-message.php?old=706348&old_path=clockwork-two-factor-authentication%2Ftrunk%2Ftemplates%2Fclockwork-test-message.php · Patch
• https://osv.dev/vulnerability/CVE-2017-17780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17780 · Security Note