CVE-2024-3111 – Interactive Content – H5P – Stored XSS to backdoor creation – POC

The WordPress ecosystem continues to be a focal point for web administrators due to its flexibility and extensive plugin ecosystem. However, this flexibility sometimes comes at the cost of security. A recent discovery (CVE-2024-3111) highlights a critical vulnerability in the Interactive Content – H5P plugin, which is actively installed on over 40,000 websites. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks, enabling attackers to create backdoors and potentially take over admin accounts.

CVE	CVE-2024-3111
Plugin	Interactive Content – H5P < 1.15.8
Critical	High
All Time	601 678
Active installations	40 000+
Publicly Published	June 9, 2024
Last Updated	June 9, 2024
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3111 https://wpscan.com/vulnerability/7c39f3b5-d407-4eb0-aa34-b498fe196c55/
Plugin Security Certification by CleanTalk
Logo of the plugin

Timeline

Discovery of the Vulnerability

During routine security assessments, researchers found that the Interactive Content – H5P plugin was susceptible to a stored XSS vulnerability. This flaw permits contributors to embed malicious JavaScript code within the plugin’s interactive content. The discovery underscores the importance of continuous security testing, especially for widely used plugins.

Understanding of Stored XSS attack’s

Cross-Site Scripting (XSS) is a type of security vulnerability typically found in web applications. It allows attackers to inject malicious scripts into web pages viewed by other users. In the context of WordPress, XSS can be particularly damaging due to the platform’s extensive use of plugins and themes, which may not always follow stringent security practices.

A real-world example is the exploitation of the content.json and svg.xml files within the H5P plugin’s archive. By injecting malicious code into these files, an attacker can execute JavaScript in the context of the victim’s browser, leading to unauthorized actions like creating new admin accounts or redirecting users to malicious sites.

Exploiting the Stored XSS Vulnerability

To exploit the vulnerability in the Interactive Content – H5P plugin, an attacker with contributor-level access can follow these steps:

POC:

You should upload archive.h5p in which will be folder content. Inside this folder will be two files: content.json, svg.xml (here is malicious code inside)

____

The primary risk associated with this vulnerability is the creation of backdoors for account takeover. Attackers can use this method to escalate their privileges from contributor to admin, gaining full control over the WordPress site. This can lead to:

• Site Defacement: Attackers can alter the website’s content, damaging the site’s reputation.
• Data Theft: Access to sensitive information stored on the website.
• Malware Distribution: Using the website as a distribution platform for malware.
• Phishing Attacks: Redirecting users to malicious websites to steal personal information.

Recommendations for Improved Security

To mitigate the risks associated with this vulnerability, the following steps are recommended:

1. Update the Plugin: Ensure that you are using the latest version of the Interactive Content – H5P plugin, as updates may contain patches for known vulnerabilities.
2. Limit Contributor Permissions: Restrict the ability of contributors to upload files or execute scripts within the website.
3. Implement Web Application Firewalls (WAF): Use a WAF to detect and block malicious activities, including XSS attacks.
4. Regular Security Audits: Conduct periodic security assessments of your WordPress site and its plugins to identify and address vulnerabilities promptly.
5. Educate Users: Train users, especially those with higher privileges, on the importance of recognizing and avoiding suspicious activities.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-3111, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #VeryHighVulnerability

Use CleanTalk solutions to improve the security of your website

DMITRII I.