CVE-2024-5573 – Easy Table of Contents – Stored XSS to backdoor creation – POC

In the ever-evolving landscape of web security, WordPress plugins frequently find themselves at the forefront of both innovation and vulnerability. The latest discovery, CVE-2024-5573, exposes a critical flaw in the popular WordPress plugin Easy Table of Contents. This vulnerability allows for a Stored Cross-Site Scripting (XSS) attack, enabling malicious actors to embed harmful JavaScript code and potentially create a backdoor for account takeovers. With over 500,000 active installations, the implications of this vulnerability are significant, warranting immediate attention and action.

CVE	CVE-2024-5573
Plugin	Easy Table of Contents < 2.0.66
Critical	High
All Time	12 222 358
Active installations	500 000+
Publicly Published	June 9, 2024
Last Updated	June 9, 2024
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5573 https://wpscan.com/vulnerability/3b01044b-355f-40d3-8e11-23a890f98c76/
Plugin Security Certification by CleanTalk
Logo of the plugin

Timeline

May 14, 2024	Plugin testing and vulnerability detection in the Easy Table of Contents have been completed
May 14, 2024	I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing
June 9, 2024	Registered CVE-2024-5573

Discovery of the Vulnerability

The vulnerability in Easy Table of Contents was uncovered during routine security testing. This particular flaw is severe because it can be exploited by users with Contributor roles or higher. By embedding a malicious script in a new post, attackers can manipulate the plugin’s settings, specifically targeting the ez-toc-settings[heading_text_tag] field. This field is vulnerable to malicious JavaScript injection, which can lead to a backdoor for account takeover.

Understanding of Stored XSS attack’s

Cross-Site Scripting (XSS) is a prevalent security issue in web applications, including WordPress. XSS vulnerabilities arise when an application includes untrusted data in a web page without proper validation or escaping. This allows attackers to execute arbitrary scripts in the context of the victim’s browser. In WordPress, XSS vulnerabilities often emerge from plugins or themes that do not adequately sanitize user inputs.

In the case of Easy Table of Contents, the XSS vulnerability is stored, meaning the malicious script is permanently stored on the target server, such as within a database, and is executed when a user visits the affected page. This type of XSS can have severe consequences, including session hijacking, defacement, and in this scenario, account takeover through backdoor creation.

Exploiting the Stored XSS Vulnerability

To exploit the CVE-2024-5573 vulnerability in Easy Table of Contents, an attacker needs to follow these steps:

POC:

You should create new post with two more heading. Go to the settings of the plugin and change “ez-toc-settings[heading_text_tag]” field to “Malicious JS code eval() and etc. For example img src=x onerror=alert(1)” -> Save Settings (Admins and editors are allowed to use JS in posts/pages/comments/etc, so the unfiltered_html capability should be disallowed when testing for Stored XSS using such roles)

____

The potential risks associated with this vulnerability are extensive. Attackers could leverage this flaw to:

• Create Backdoors: Persistently access compromised accounts even after detection.
• Hijack Sessions: Steal session cookies and hijack active user sessions.
• Deface Websites: Alter the appearance of the site or display unwanted content.
• Steal Sensitive Data: Access confidential user data or administrative functions.

Real-world scenarios might include an attacker gaining administrative privileges, altering critical site settings, or spreading the exploit to other users who interact with the compromised site.

Recommendations for Improved Security

To mitigate the risks associated with CVE-2024-5573, the following steps are recommended:

1. Update the Plugin: Ensure that the Easy Table of Contents plugin is updated to the latest version, where the vulnerability is patched.
2. Sanitize Inputs: Implement robust input validation and sanitization to prevent malicious code from being accepted.
3. Restrict Unfiltered HTML: Limit the use of the unfiltered_html capability to trusted users only, minimizing the risk of XSS exploits.
4. Regular Security Audits: Conduct periodic security audits of plugins and themes to identify and address vulnerabilities proactively.
5. Educate Users: Train users on the importance of security best practices, particularly those with elevated privileges.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-5573, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #VeryHighVulnerability

Use CleanTalk solutions to improve the security of your website

DMITRII I.