CVE-2024-11433

Executive Summary

CVE-2024-11433 is a Stored Cross-Site Scripting (XSS) vulnerability in the Surbma | SalesAutopilot Shortcode plugin for WordPress, affecting all versions up to and including 2.5. The vulnerability resides in the plugin's sa-form shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. When a user accesses an injected page, the malicious script executes, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site. The vulnerability has a CVSS score of 6.4 (Medium), and no public exploit or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the requirement for authenticated access, but the potential for widespread impact on site visitors and the ease of exploitation make it a significant concern for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The sa-form shortcode is used to embed SalesAutopilot forms into posts and pages. The plugin fails to properly sanitize and escape user-supplied attributes passed to the shortcode. When an attacker with contributor-level access or higher creates or edits a post/page and includes the sa-form shortcode with malicious attributes, the injected script is stored in the database. When any user (including administrators and visitors) views the page, the script executes in their browser context.

The root cause is insufficient input validation and output escaping. The plugin likely uses add_shortcode() and directly outputs attribute values without using WordPress's built-in escaping functions like esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function sa_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'form_id' => '',
        'class' => '',
    ), $atts);
    // Direct output without escaping
    return '<div class="' . $atts['class'] . '">Form ID: ' . $atts['form_id'] . '</div>';
}
add_shortcode('sa-form', 'sa_form_shortcode');

Patched Code (Conceptual):

function sa_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'form_id' => '',
        'class' => '',
    ), $atts);
    // Proper escaping
    $class = esc_attr($atts['class']);
    $form_id = esc_attr($atts['form_id']);
    return '<div class="' . $class . '">Form ID: ' . $form_id . '</div>';
}
add_shortcode('sa-form', 'sa_form_shortcode');

The patched version uses esc_attr() to escape attribute values before output, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Surbma | SalesAutopilot Shortcode plugin <= 2.5
• Contributor-level account or higher

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. In the content editor, insert the following shortcode with a malicious payload:

   [sa-form class="test\" onmouseover=\"alert('XSS')\""]
   

4. Publish the post.
5. When any user hovers over the injected element, the XSS payload executes.

Alternative Payload:

[sa-form form_id="1\" onfocus=\"alert(document.cookie)\" autofocus="]

Blue Team

Detection:

• Monitor for posts/pages containing the sa-form shortcode with unusual attribute values.
• Look for patterns like on*= or javascript: in shortcode attributes.
• Review contributor-level user activity for suspicious post creation.

Prevention:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/surbma-salesautopilot-shortcode/ (presence of vulnerable plugin)
• Database: Posts/pages containing [sa-form with on*= or javascript: attributes
• Network: Outbound connections to attacker-controlled domains from compromised pages
• Logs: WordPress audit logs showing creation of posts with suspicious shortcode usage

Detection Engineering

YARA Rule

rule CVE_2024_11433_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Surbma SalesAutopilot plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11433"
    strings:
        $shortcode = /\[sa-form[^\]]*?on\w+\s*=\s*["'][^"']*?["']/ nocase
        $javascript = /javascript\s*:/ nocase
    condition:
        $shortcode or $javascript
}

Sigma Rule

title: CVE-2024-11433 Stored XSS via Surbma SalesAutopilot Shortcode
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via sa-form shortcode attributes
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'sa-form'
        http.url|re: 'on\w+=["\']'
    condition: selection
falsepositives:
    - Legitimate use of event handlers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11433 Stored XSS via Surbma SalesAutopilot Shortcode"; flow:to_server,established; content:"sa-form"; http_uri; pcre:"/on\w+\s*=\s*[\x27\x22][^\x27\x22]*[\x27\x22]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and clean any posts/pages containing suspicious sa-form shortcodes.
3. Reset passwords for all contributor-level accounts if compromise is suspected.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Implement input validation and output escaping in custom shortcodes.
• Use WordPress security plugins to monitor for XSS attempts.

Workarounds:

• Restrict contributor-level access to only trusted users.
• Use a Content Security Policy (CSP) to mitigate XSS impact.
• Employ a WAF with XSS detection rules.

Valters IT signature: This report is generated for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.