CVE-2024-10647

Executive Summary

CVE-2024-10647 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin. The flaw exists in all versions up to and including 1.9.244. It arises from the insecure use of remove_query_arg without proper output escaping on a URL parameter. An unauthenticated attacker can inject arbitrary web scripts that execute in the context of a victim’s browser if the victim clicks a crafted link. The CVSS score is 6.1 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation at the time of analysis. No public exploit code or patch details are available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress admin dashboard or via the repository are at risk. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a malicious link.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack requires user interaction, but the impact is limited to script execution in the victim’s browser.

Deep Dive & Mechanics

The vulnerability is located in the WS Form LITE plugin’s handling of URL parameters. The function remove_query_arg is used to clean up query strings, but the output is not properly escaped before being rendered in the HTML response. This allows an attacker to inject arbitrary JavaScript code via a crafted URL.

Root Cause: The plugin fails to sanitize or escape the URL parameter before using it in a redirect or link generation. When a user clicks a malicious link, the injected script executes in the context of the WordPress admin or front-end page.

Attack Vector: An attacker crafts a URL containing a malicious payload in a query parameter (e.g., ?param=<script>alert('XSS')</script>). The victim clicks the link, and the script executes.

Impact: The attacker can steal session cookies, perform actions on behalf of the victim, deface the page, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.9.244):

// Example of insecure use of remove_query_arg
$url = remove_query_arg( 'some_param', $current_url );
echo '<a href="' . $url . '">Click here</a>';

The $url is not escaped, allowing XSS.

Patched Code (Hypothetical):

// Properly escape the URL
$url = remove_query_arg( 'some_param', $current_url );
echo '<a href="' . esc_url( $url ) . '">Click here</a>';

The esc_url() function ensures the URL is safe for output.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Craft the malicious URL:
   http://target-site.com/wp-admin/admin.php?page=ws-form&_wp_http_referer=<script>alert('XSS')</script>
2. Deliver the link: Send via email, social engineering, or embed in a forum post.
3. Victim clicks: The script executes in the victim’s browser.

Proof-of-Concept (No public exploit available):

<a href="http://target-site.com/wp-admin/admin.php?page=ws-form&_wp_http_referer=<script>alert('XSS')</script>">Click me</a>

Blue Team (Detection & Defense)

• Monitor logs for unusual query parameters containing <script> or onerror patterns.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use Web Application Firewall (WAF) rules to filter XSS payloads.

Indicators of Compromise (IOCs)

• URL patterns:
  *?page=ws-form&_wp_http_referer=*<script>*
*?page=ws-form&_wp_http_referer=*onerror=*
• Log entries:
  GET /wp-admin/admin.php?page=ws-form&_wp_http_referer=%3Cscript%3E
• Network traffic:
  Outbound connections to attacker-controlled domains after script execution.

Detection Engineering

YARA Rule

rule CVE_2024_10647_WS_Form_XSS {
    meta:
        description = "Detects malicious URLs targeting WS Form LITE XSS vulnerability"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10647"
    strings:
        $xss1 = /page=ws-form.*_wp_http_referer=.*<script>/i
        $xss2 = /page=ws-form.*_wp_http_referer=.*onerror=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-10647 WS Form LITE Reflected XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with XSS payloads targeting WS Form LITE plugin
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - 'page=ws-form'
            - '_wp_http_referer='
        cs-uri-query|re: 
            - '<script'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of similar parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10647 WS Form LITE Reflected XSS"; flow:to_server,established; content:"page=ws-form"; http_uri; content:"_wp_http_referer="; http_uri; pcre:"/<script|onerror=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WS Form LITE plugin until a patch is available.
2. Short-term: Implement a WAF rule to block requests containing _wp_http_referer= with script tags.
3. Long-term: Apply the vendor patch when released. Ensure all WordPress plugins are updated.
4. User education: Train users not to click suspicious links.

Valters IT
Securing Digital Frontiers