CVE-2024-9775

Executive Summary

CVE-2024-9775 is a Stored Cross-Site Scripting (XSS) vulnerability in the Anih - Creative Agency WordPress Theme (WordPress ecosystem). The flaw exists in all versions up to and including 2024, due to an incomplete blacklist, insufficient input sanitization, and output escaping in admin settings. This allows authenticated attackers with administrator-level permissions (or higher) to inject arbitrary web scripts that execute when any user accesses an injected page. The vulnerability is limited to multi-site installations or installations where unfiltered_html has been disabled. The CVSS score is 5.5 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via the official WordPress theme repository or third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are involved. The risk is primarily to site administrators who install the theme and grant elevated permissions to untrusted users on multi-site networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level access
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. Exploitation requires authenticated admin access, but on multi-site installations, a lower-privileged administrator on a subsite could inject scripts that affect the entire network.

Deep Dive & Mechanics

The vulnerability resides in the theme's admin settings panel. The theme fails to properly sanitize and escape user-supplied input when saving configuration options. An incomplete blacklist allows certain HTML tags and attributes to bypass filters, enabling the injection of JavaScript event handlers (e.g., onmouseover, onload) or <script> tags.

Root Cause:

• Incomplete Blacklist: The theme attempts to block dangerous HTML elements but misses specific vectors (e.g., <svg/onload=...>, <img src=x onerror=...>).
• Insufficient Input Sanitization: User input is not passed through WordPress's wp_kses() or similar sanitization functions.
• Output Escaping: When rendering the saved settings, the theme does not use esc_html() or esc_attr(), allowing raw HTML to be output.

Attack Flow:

1. Attacker with admin privileges navigates to the theme's settings page.
2. Attacker injects malicious JavaScript into a text field (e.g., theme custom CSS, footer text, or custom scripts option).
3. The payload is stored in the WordPress database.
4. When any user (including lower-privileged users or visitors) loads a page that renders the injected setting, the script executes in their browser.

Affected Components:

• Theme admin settings page (likely functions.php or custom admin page)
• Database options table (e.g., wp_options)

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In theme's admin settings save function
update_option('anih_custom_css', $_POST['anih_custom_css']);

Patched Code (Expected):

// Proper sanitization and escaping
$sanitized_css = wp_kses_post( $_POST['anih_custom_css'] );
update_option('anih_custom_css', $sanitized_css);

Output (Vulnerable):

echo $custom_css; // No escaping

Output (Patched):

echo esc_html( $custom_css ); // Escaped output

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress multi-site installation with the Anih theme active.
• Attacker has administrator-level access to at least one subsite.
• unfiltered_html capability is disabled for administrators (default on multi-site).

Exploitation Steps:

1. Log in as an admin on a subsite.
2. Navigate to Appearance > Theme Settings (or similar).
3. Locate a text field that is not properly sanitized (e.g., "Custom CSS" or "Footer Scripts").
4. Inject the following payload:

   <svg onload=alert('XSS')>
   

5. Save the settings.
6. Any user visiting a page that renders this setting will trigger the XSS.

Alternative Payloads:

<img src=x onerror=alert(document.cookie)>

<iframe src=javascript:alert('XSS')>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual admin activity, especially changes to theme options.
• Look for suspicious strings in the wp_options table (e.g., onload, onerror, <script>).
• Use WAF rules to block common XSS payloads in admin POST requests.

Hardening:

• Disable the theme until a patch is released.
• Restrict admin access to trusted users only.
• Enable unfiltered_html only for super admins on multi-site.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:
  • Modified theme files (e.g., functions.php, admin-settings.php)
  • Suspicious entries in wp_options table with key anih_*
• Network Indicators:
  • Outbound connections to attacker-controlled domains from admin pages
  • HTTP requests containing XSS payloads in POST data to /wp-admin/admin-ajax.php or theme settings endpoints
• Log Indicators:
  • WordPress debug log entries showing unexpected HTML in option values
  • Web server logs with alert( or onerror= in request bodies

Detection Engineering

YARA Rule

rule CVE_2024_9775_Anih_XSS {
    meta:
        description = "Detects stored XSS payloads in Anih theme options"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-9775"
    strings:
        $xss1 = /<[^>]*on\w+\s*=[^>]*>/i
        $xss2 = /<script[^>]*>.*<\/script>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-9775 - Stored XSS in Anih Theme Settings
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress Anih theme options
author: Valters IT
date: 2025-04-17
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # WordPress option update
        OptionName|startswith: 'anih_'
        OptionValue|contains:
            - '<script'
            - 'onload='
            - 'onerror='
            - 'onmouseover='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in theme settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9775 - Anih Theme Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/"; http_uri; content:"anih"; http_client_body; pcre:"/<[^>]*on\w+\s*=[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Anih theme on all WordPress installations until a patched version is released.
2. Switch to an alternative theme that is actively maintained.
3. Audit user permissions – ensure only trusted users have admin access on multi-site networks.

Long-Term Fix:

• The vendor (Anih) must release a patched version that:
  • Uses wp_kses() or sanitize_text_field() for all user inputs.
  • Escapes all output with esc_html() or esc_attr().
  • Removes the incomplete blacklist in favor of a whitelist approach.

Workarounds:

• Implement a Web Application Firewall (WAF) rule to block XSS payloads in admin POST requests.
• Add the following to wp-config.php to disable unfiltered_html for all users:

  define('DISALLOW_UNFILTERED_HTML', true);
  

Patch Status: UNKNOWN – No official patch available. Monitor the WordPress theme repository for updates.

Valters IT
Securing Digital Ecosystems