CVE-2024-10793

Executive Summary

CVE-2024-10793 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Activity Log plugin for WordPress, affecting all versions up to and including 5.2.1. The vulnerability resides in the user_id parameter, which is insufficiently sanitized and escaped. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrative user accesses an injected page. The CVSS score is 7.2 (High), with a low EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available. As this is a WordPress plugin vulnerability, it is a WordPress ecosystem issue and not related to the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin package by checking checksums provided by the repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – an admin must access the injected page
• Scope: Changed (S:C) – the vulnerability can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: High. Although no active exploitation is reported, the low complexity and network attack vector make it attractive for attackers. The requirement for admin interaction reduces immediate risk but does not eliminate it.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the user_id parameter of the WP Activity Log plugin. The plugin logs user activities, including user IDs. When an attacker sends a crafted request with a malicious payload in the user_id parameter, the plugin stores this payload in the database. When an administrator views the activity log, the payload is rendered without proper sanitization or output escaping, leading to script execution in the admin's browser.

Root Cause: Insufficient input sanitization and output escaping in the handling of the user_id parameter. The plugin fails to use WordPress's built-in escaping functions like esc_html() or esc_attr() when outputting the user ID in the admin interface.

Attack Flow:

1. Attacker sends a request to a WordPress endpoint that triggers the plugin's logging functionality, injecting a malicious script in the user_id parameter.
2. The plugin stores the malicious payload in the database.
3. An administrator navigates to the activity log page.
4. The plugin retrieves and outputs the stored payload without escaping.
5. The malicious script executes in the admin's browser, potentially stealing session cookies, performing actions on behalf of the admin, or defacing the site.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.2.1):

// In a logging function
$user_id = $_REQUEST['user_id']; // No sanitization
// ... later in output
echo "<td>" . $user_id . "</td>"; // No escaping

Patched Code (Hypothetical):

// In a logging function
$user_id = sanitize_text_field($_REQUEST['user_id']); // Sanitize input
// ... later in output
echo "<td>" . esc_html($user_id) . "</td>"; // Escape output

The patch would involve using sanitize_text_field() on input and esc_html() on output to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Activity Log plugin version <= 5.2.1
• Ability to send HTTP requests to the site

Exploitation Steps:

1. Identify an endpoint that triggers the plugin's logging with the user_id parameter. This could be a login attempt or user profile update.
2. Craft a request with a malicious payload in the user_id parameter:

   POST /wp-login.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   log=admin&pwd=test&user_id=<script>alert('XSS')</script>
   

3. The plugin logs the event with the malicious user_id.
4. An administrator visits the activity log page (e.g., /wp-admin/admin.php?page=wsal-auditlog).
5. The script executes, displaying an alert or performing more malicious actions.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual user_id parameters in POST requests to login or user-related endpoints.
• Look for patterns like <script>, onerror=, or other XSS vectors in log entries.
• Use the detection rules provided below.

Hunting:

• Search the database for stored XSS payloads in the plugin's log table (e.g., wp_wsal_occurrences).
• Review recent activity log entries for suspicious user IDs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with user_id parameter containing <script> tags or JavaScript event handlers.
  • Outbound connections from the admin browser to attacker-controlled domains (if payload exfiltrates data).
• Host:
  • Stored XSS payloads in the WordPress database, specifically in the wp_wsal_occurrences table.
  • Modified admin user sessions or unexpected admin actions.
• File:
  • No specific file IOCs; the vulnerability is data-driven.

Detection Engineering

YARA Rule

rule CVE_2024_10793_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Activity Log user_id parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10793"
    strings:
        $xss1 = /user_id[^&]*<script[^>]*>/i
        $xss2 = /user_id[^&]*on\w+=/i
        $xss3 = /user_id[^&]*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-10793 Stored XSS in WP Activity Log
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stored XSS via user_id parameter in WP Activity Log plugin
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10793
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'user_id='
        cs-uri-query|re: '(user_id[^&]*<script[^>]*>)|(user_id[^&]*on\w+=)|(user_id[^&]*javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in user IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10793 Stored XSS in WP Activity Log"; flow:to_server,established; content:"POST"; http_method; content:"user_id="; http_client_body; pcre:"/user_id[^&]*(<script[^>]*>|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update to the latest version immediately.
2. Disable the plugin: If no patch is available, consider disabling the WP Activity Log plugin until a fix is released.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing XSS patterns in the user_id parameter.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit WordPress plugins for vulnerabilities.
• Use WordPress security plugins that provide virtual patching.

Workarounds:

• If the plugin cannot be disabled, restrict access to the activity log page to trusted IPs only.
• Monitor logs for suspicious activity and manually review user IDs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert