CVE-2024-1424

Executive Summary

CVE-2024-1424 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress. The flaw exists in all versions up to and including 3.5.1, stemming from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts that execute whenever a victim accesses the compromised page. This vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects the GiveWP WordPress plugin, which is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files by checking checksums provided by the repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for organizations relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must access the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread impact on donation pages, which often handle sensitive user data.

Deep Dive & Mechanics

The vulnerability resides in the GiveWP plugin's shortcode handling. Shortcodes are parsed by WordPress, and user-supplied attributes are directly embedded into the page output without proper sanitization or escaping. An attacker with contributor-level access can craft a shortcode with malicious JavaScript in an attribute, such as:

[give_form id="123" onmouseover="alert('XSS')"]

When the page is rendered, the onmouseover attribute executes the script. The stored nature means the payload persists in the database and executes for every visitor.

The root cause is the lack of esc_attr() or wp_kses() filtering on shortcode attributes before output. The plugin's do_shortcode function does not validate or escape these inputs, allowing arbitrary HTML/JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.5.1):

// In give-form-shortcode.php
function give_form_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'id' => '',
        'show_title' => true,
        'show_goal' => true,
        // ...
    ), $atts, 'give_form' );

    // Directly outputting attributes without escaping
    $output = '<div class="give-form" data-id="' . $atts['id'] . '">';
    // ...
    return $output;
}

Patched Code (Hypothetical):

function give_form_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'id' => '',
        'show_title' => true,
        'show_goal' => true,
        // ...
    ), $atts, 'give_form' );

    // Escape attributes before output
    $output = '<div class="give-form" data-id="' . esc_attr( $atts['id'] ) . '">';
    // ...
    return $output;
}

The patch requires adding esc_attr() to all user-supplied attributes and using wp_kses_post() for any HTML content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with GiveWP <= 3.5.1
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert a shortcode with a malicious attribute:

   [give_form id="1" onmouseover="alert(document.cookie)"]
   

4. Publish the page.
5. When any user (including admins) visits the page, the script executes.

Advanced Payload:

[give_form id="1" style="x:expression(alert(1))"]

Or using event handlers like onfocus, onclick, etc.

Blue Team

Detection:

• Monitor for posts/pages containing shortcodes with unusual attributes (e.g., on*, style, javascript:).
• Use WAF rules to block requests with suspicious shortcode attributes.
• Review user activity logs for contributor-level users creating or editing posts with shortcodes.

Mitigation:

• Disable the GiveWP plugin until a patch is applied.
• Restrict contributor-level permissions to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/givewp/includes/shortcodes/give-form-shortcode.php (vulnerable file)
• Database: Posts/pages containing shortcodes with event handler attributes (e.g., onmouseover, onclick)
• Network: HTTP requests to pages with malicious shortcodes
• Logs: WordPress debug logs showing unexpected shortcode attributes

Detection Engineering

YARA Rule

rule CVE_2024_1424_GiveWP_XSS {
    meta:
        description = "Detects malicious shortcode attributes in GiveWP plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1424"
    strings:
        $shortcode = /\[give_form[^\]]*?(on\w+|style|javascript)[^\]]*?\]/i
        $vuln_file = "give-form-shortcode.php"
    condition:
        $shortcode or $vuln_file
}

Sigma Rule

title: CVE-2024-1424 GiveWP Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in GiveWP plugin via shortcode attributes
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "/wp-content/plugins/givewp/"
        cs-method: "GET"
        cs-uri-query|re: '\[give_form[^\]]*?(on\w+|style|javascript)[^\]]*?\]'
    condition: selection
falsepositives:
    - Legitimate use of shortcodes with safe attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1424 GiveWP Stored XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/givewp/"; http_uri; pcre:"/\[give_form[^\]]*?(on\w+|style|javascript)[^\]]*?\]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the GiveWP plugin if not critical to operations.
2. Short-term: Restrict contributor-level permissions to trusted users only.
3. Long-term: Apply a patch from the vendor once available. Monitor the GiveWP changelog for version 3.5.2 or higher.
4. Workaround: Use a Web Application Firewall (WAF) to block requests containing malicious shortcode patterns.
5. Monitoring: Enable WordPress debug logging and review for unexpected shortcode attributes.

Valters IT
Securing Digital Frontiers