CVE-2024-11199

Executive Summary

CVE-2024-11199 is a Stored Cross-Site Scripting (XSS) vulnerability in the Rescue Shortcodes plugin for WordPress, affecting all versions up to and including 2.9. The flaw resides in the rescue_progressbar shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a user visits an infected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx.

WordPress Ecosystem & Plugin Security

This vulnerability is a classic example of stored XSS in a WordPress plugin. The rescue_progressbar shortcode fails to sanitize attributes like title or percentage, allowing attackers to inject JavaScript. Since WordPress allows contributors to create posts with shortcodes, the attack surface is significant. No patch is currently available, making this a high-priority issue for site administrators.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim visits page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the lack of a patch and the potential for widespread exploitation in WordPress environments elevates the threat.

Deep Dive & Mechanics

The vulnerability is in the rescue_progressbar shortcode handler. The plugin likely processes attributes like title and percentage without proper sanitization. For example, the shortcode [rescue_progressbar title="<script>alert('XSS')</script>" percentage="50"] would store the malicious script in the database. When the shortcode is rendered, the unsanitized attribute is output directly into the HTML, executing the script.

The root cause is insufficient input validation and output escaping. WordPress provides functions like esc_attr() and wp_kses_post() for safe output, but the plugin fails to use them. The attack vector is through the WordPress post editor, where contributors can insert shortcodes.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function rescue_progressbar_shortcode($atts) {
    $title = $atts['title'];
    $percentage = $atts['percentage'];
    return "<div class='progress-bar' data-title='$title' data-percentage='$percentage'></div>";
}

Patched Code (Conceptual):

function rescue_progressbar_shortcode($atts) {
    $title = esc_attr($atts['title']);
    $percentage = intval($atts['percentage']);
    return "<div class='progress-bar' data-title='$title' data-percentage='$percentage'></div>";
}

The patched version uses esc_attr() to escape the title and intval() to ensure the percentage is numeric, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress instance with Rescue Shortcodes <= 2.9, a contributor-level account.
2. Steps:
   • Log in as a contributor.
   • Create a new post or page.
   • Insert the shortcode: [rescue_progressbar title="<script>alert(document.cookie)</script>" percentage="50"]
   • Publish the post.
   • When an admin or visitor views the post, the script executes.

Proof-of-Concept (PoC):

[rescue_progressbar title="<img src=x onerror=alert('XSS')>" percentage="100"]

Blue Team (Detection & Response)

1. Monitor WordPress logs for unusual shortcode usage.
2. Scan posts for suspicious shortcode attributes using a security plugin.
3. Implement WAF rules to block XSS payloads in shortcode attributes.
4. Restrict contributor permissions if possible.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/rescue-shortcodes/ (presence of vulnerable version)
• Database: Posts containing shortcodes with <script> or onerror attributes.
• Network: Outbound connections from compromised sites to attacker-controlled domains.
• Logs: Unusual post creation by contributors with shortcode attributes containing JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_11199_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Rescue Shortcodes plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11199"
    strings:
        $xss1 = /\[rescue_progressbar[^\]]*title\s*=\s*["'][^"']*<script/i
        $xss2 = /\[rescue_progressbar[^\]]*title\s*=\s*["'][^"']*onerror/i
        $xss3 = /\[rescue_progressbar[^\]]*title\s*=\s*["'][^"']*onload/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Rescue Shortcodes Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-admin/post.php"
        http.body|contains: "[rescue_progressbar"
        http.body|contains|re: "(<script|onerror|onload)"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11199 Stored XSS in Rescue Shortcodes"; flow:to_server,established; content:"[rescue_progressbar"; http_client_body; pcre:"/<script|onerror|onload>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Rescue Shortcodes plugin until a patch is available.
2. Short-term: Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
3. Long-term: Apply the vendor patch when released. If no patch is forthcoming, consider replacing the plugin with an alternative.
4. Compensating Controls: Restrict contributor-level access to trusted users only. Regularly audit posts for malicious shortcodes.

Valters IT Securing Digital Frontiers