CVE-2024-10390

Executive Summary

CVE-2024-10390 is a medium-severity vulnerability affecting the Elfsight Telegram Chat CC plugin for WordPress up to version 1.1.0. The flaw resides in the updatePreferences function, which lacks a proper capability check, allowing authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts (stored XSS). This can lead to session hijacking, defacement, or redirection of users who visit compromised pages. The vulnerability is within the WordPress plugin ecosystem and does not affect the core WordPress or server software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Changed (affects other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privilege requirement and the ability to execute scripts in the context of other users, potentially leading to broader compromise.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) combined with Stored Cross-Site Scripting (CWE-79). The updatePreferences AJAX action in the Elfsight Telegram Chat CC plugin does not verify that the current user has the necessary capabilities (e.g., edit_posts or manage_options) before processing the request. An attacker with subscriber-level access can craft a request to update preferences with malicious JavaScript payloads. These payloads are stored in the WordPress database and executed when any user (including administrators) views a page that loads the plugin’s settings or chat interface.

The attack flow:

1. Attacker logs in as a subscriber.
2. Sends a POST request to /wp-admin/admin-ajax.php with action updatePreferences and a malicious payload in the preferences parameter.
3. The plugin stores the payload without sanitization.
4. When an admin or other user visits a page that renders the plugin, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.1.0):

add_action('wp_ajax_updatePreferences', 'updatePreferences');
function updatePreferences() {
    $preferences = $_POST['preferences'];
    update_option('elfsight_telegram_chat_preferences', $preferences);
    wp_send_json_success();
}

The function lacks a current_user_can() check.

Patched Code (Hypothetical):

add_action('wp_ajax_updatePreferences', 'updatePreferences');
function updatePreferences() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $preferences = sanitize_text_field($_POST['preferences']);
    update_option('elfsight_telegram_chat_preferences', $preferences);
    wp_send_json_success();
}

The patch adds a capability check and input sanitization.

Exploitation & Lab Setup

Red Team (Exploitation):

1. Prerequisites: Valid subscriber account on a WordPress site with the vulnerable plugin.
2. Craft Payload: Create a JavaScript payload (e.g., <script>alert('XSS')</script>).
3. Send Request:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
   -d "action=updatePreferences&preferences=<script>alert('XSS')</script>" \
   --cookie "wordpress_logged_in_xxx=..."
   

4. Trigger: Visit any page that loads the plugin’s chat interface.

Blue Team (Detection & Response):

• Monitor AJAX requests to admin-ajax.php with action updatePreferences from low-privilege users.
• Look for unusual preferences parameters containing HTML/JavaScript.
• Review WordPress options table for unexpected values in elfsight_telegram_chat_preferences.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=updatePreferences and preferences containing <script> tags.
• Host: WordPress options table entry elfsight_telegram_chat_preferences containing malicious JavaScript.
• Logs: WordPress debug log entries showing unauthorized AJAX calls from subscriber roles.

Detection Engineering

YARA Rule:

rule detect_elfsight_xss_payload {
    meta:
        description = "Detects stored XSS payload in Elfsight Telegram Chat preferences"
        author = "Valters IT"
        date = "2024-10-27"
    strings:
        $payload = /<script[^>]*>.*<\/script>/i
        $option = "elfsight_telegram_chat_preferences"
    condition:
        $option and $payload
}

Sigma Rule:

title: Elfsight Telegram Chat CC Stored XSS via updatePreferences
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized AJAX requests to updatePreferences with script payloads
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=updatePreferences
        cs-uri-query|contains: <script
    condition: selection
falsepositives:
    - Legitimate plugin updates (unlikely)
level: high

Suricata Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Elfsight Telegram Chat CC Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=updatePreferences"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Elfsight Telegram Chat CC plugin until a patch is available.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block updatePreferences requests containing <script> tags.
3. Long-term: Apply the vendor patch when released, or manually add capability checks and input sanitization to the plugin code.
4. User Education: Ensure all WordPress users, especially subscribers, are aware of the risks of XSS.

Valters IT
Securing WordPress Ecosystems