CVE-2024-49593

Executive Summary

CVE-2024-49593 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Advanced Custom Fields (ACF) and Secure Custom Fields plugins for WordPress. The flaw resides in the Field Group editor, where a user with sufficient privileges (e.g., Administrator) can inject malicious JavaScript into field configuration. This payload is then executed when another administrator views or edits the same field group. The vulnerability is present in ACF versions before 6.3.9 and Secure Custom Fields before 6.3.6.3. The CVSS score is 0.0 in the NVD data, but based on the description, a more realistic vector is provided above. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk is elevated due to the widespread use of these plugins.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugins are distributed via the WordPress plugin repository and the WP Engine alternative update mechanism. Users should verify they are receiving updates from a trusted source. The patch is available through the standard WordPress update process or the WP Engine alternative channel.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely via the WordPress admin interface.
• Attack Complexity (AC): Low (L) - No special conditions are required beyond having an admin account.
• Privileges Required (PR): High (H) - An attacker needs administrator-level access to the WordPress site.
• User Interaction (UI): Required (R) - The payload is triggered when another admin views the malicious field group.
• Scope (S): Changed (C) - The XSS can impact the victim's browser session, potentially leading to privilege escalation or data theft.
• Confidentiality (C): Low (L) - Limited information disclosure possible.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): None (N) - No direct impact on availability.

Threat Level: Medium. While the CVSS base score is low (4.8), the potential for privilege escalation and lateral movement within the WordPress admin panel increases the risk.

Deep Dive & Mechanics

The vulnerability exists in the Field Group editor of ACF and Secure Custom Fields. When an administrator creates or edits a field group, they can define various field settings (e.g., field name, instructions, default value). The plugin fails to properly sanitize or escape user-supplied input in certain field parameters before storing it in the database. When another administrator later views or edits that field group, the unsanitized data is rendered in the admin interface, allowing the stored XSS payload to execute.

The attack flow is as follows:

1. An attacker with admin privileges creates a new field group or edits an existing one.
2. The attacker injects a malicious JavaScript payload into a field parameter (e.g., the "Instructions" field or a custom field label).
3. The payload is stored in the WordPress database.
4. When another administrator navigates to the Field Group editor (e.g., Custom Fields > Field Groups), the payload is executed in their browser.
5. The attacker can then perform actions such as creating new admin users, exfiltrating data, or modifying site content.

Vulnerable vs. Patched Code

Vulnerable Code (ACF < 6.3.9): In the vulnerable version, the plugin outputs field parameters directly without proper escaping. For example, in the acf_field_group class, the render_field method might output the instructions field without using esc_attr() or wp_kses().

// Vulnerable: Direct output without escaping
echo '<div class="acf-field-instructions">' . $field['instructions'] . '</div>';

Patched Code (ACF 6.3.9): The patched version sanitizes the output using WordPress's built-in escaping functions.

// Patched: Escaped output
echo '<div class="acf-field-instructions">' . esc_html( $field['instructions'] ) . '</div>';

The patch ensures that any HTML or JavaScript in the field parameters is encoded, preventing XSS.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with ACF < 6.3.9 or Secure Custom Fields < 6.3.6.3.
• Administrator-level credentials.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Custom Fields > Field Groups.
3. Create a new field group or edit an existing one.
4. In the "Instructions" field (or another vulnerable parameter), inject the following payload:

   <script>alert('XSS')</script>
   

5. Save the field group.
6. As another admin user, navigate to Custom Fields > Field Groups. The alert will execute.

Advanced Payload: To steal admin cookies or perform actions, use:

<script>
fetch('/wp-admin/admin-ajax.php?action=create_user&user_login=attacker&user_pass=password&role=administrator');
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual field group modifications in the WordPress admin.
• Look for JavaScript payloads in the post_content or meta_value of the acf-field-group post type.
• Use the Sigma rule below to detect XSS attempts in HTTP requests.

Hunting:

• Query the database for field groups containing <script> tags:

  SELECT * FROM wp_posts WHERE post_type = 'acf-field-group' AND post_content LIKE '%<script>%';
  

• Review admin user activity logs for suspicious field group edits.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified wp_posts table entries with post_type = 'acf-field-group' containing <script> tags.
  • Presence of JavaScript payloads in the acf meta keys (e.g., _acf_field_group).

• Network Indicators:

  • HTTP requests to /wp-admin/admin-ajax.php with suspicious parameters (e.g., action=create_user).
  • Outbound connections to attacker-controlled domains from the WordPress admin.

• Behavioral Indicators:

  • Unexpected creation of new admin users.
  • Unusual field group edits by non-admin users (if privilege escalation occurs).

Detection Engineering

YARA Rule

rule CVE_2024_49593_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ACF field groups"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-49593"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $acf_field_group = "acf-field-group"
    condition:
        $acf_field_group and #xss_payload > 0
}

Sigma Rule

title: CVE-2024-49593 Stored XSS in ACF Field Group Editor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Advanced Custom Fields plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=acf\/field_group\/save'
    keywords:
        - '<script>'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in field instructions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-49593 Stored XSS in ACF Field Group"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=acf/field_group/save"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugins: Upgrade Advanced Custom Fields to version 6.3.9 or later, and Secure Custom Fields to 6.3.6.3 or later.
2. Review Field Groups: Audit existing field groups for any suspicious content. Remove any field groups that contain unexpected JavaScript.
3. Reset Admin Passwords: If exploitation is suspected, force password resets for all admin users.

Long-Term Mitigations:

• Principle of Least Privilege: Limit the number of users with administrator access to the WordPress site.
• Web Application Firewall (WAF): Deploy a WAF with rules to block XSS payloads in admin requests.
• Regular Audits: Periodically review field group configurations for unauthorized changes.
• Backup: Maintain regular backups of the WordPress database to facilitate recovery.

Workaround (if patching is not immediately possible):

• Disable the Field Group editor for non-essential users by removing their edit_acf_field_groups capability.
• Use a security plugin to monitor and block suspicious admin activity.

Valters IT