CVE-2024-13208 – WP Google Map – Stored XSS to JS Backdoor Creation – POC

Google Maps is an essential feature for many websites, enabling businesses and organizations to display interactive maps for better user engagement. WP Google Map is a WordPress plugin designed to simplify the integration of Google Maps into websites. This user-friendly tool provides extensive customization options, making it a favorite among WordPress users. However, recent security research uncovered a critical stored Cross-Site Scripting (XSS) vulnerability in the plugin, identified as CVE-2024-13208. This vulnerability has the potential to compromise the security of websites using the plugin, highlighting the importance of robust security measures.

CVE	CVE-2024-13208
Plugin	WP Google Map
Critical	Medium
All Time	884 000
Active installations	10 000+
Publicly Published	January 24, 2024
Last Updated	January 24, 2024
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://wpscan.com/vulnerability/f86d4f64-208f-407f-8d2c-a89b5e0ac777/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13208
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

The vulnerability was identified in the WP Google Map plugin when researchers examined its functionality for adding and managing maps. During testing, they discovered that the plugin’s “Markers” feature failed to properly sanitize user inputs, particularly in the “Marker Description” field. This oversight allowed attackers to inject malicious JavaScript payloads, which would execute when the map containing the malicious marker was loaded on a web page.

The vulnerability is exploitable by users with access to the plugin’s “Add New” and “Markers” functionalities. Once an attacker injects a payload, the code is stored persistently in the marker description and executed when users view the map.

Understanding of XSS attack’s

Cross-Site Scripting (XSS) is a prevalent web vulnerability that allows attackers to inject malicious scripts into trusted websites. Stored XSS occurs when the malicious payload is permanently stored on the target server, typically in a database, and executed whenever a user accesses the affected page.

In the context of WordPress, stored XSS can be particularly damaging due to the platform’s widespread use and the diversity of plugins and themes. Attackers often exploit XSS to execute JavaScript in a user’s browser, potentially stealing session cookies, redirecting users to malicious websites, or defacing web pages.

Exploiting the XSS Vulnerability

Exploiting CVE-2024-13208 requires access to the WP Google Map plugin’s marker management interface. Here’s how an attacker can exploit it:

POC:

1.Gain Contributor or higher-level access to the WordPress site.
2. Use the plugin to create a new map.
3. Insert a crafted payload into the "Marker Description" field.
4. Save the marker and ensure it appears on a published page or post.
5. Wait for a site admin or visitor to view the page containing the malicious map, triggering the payload.
The persistent nature of stored XSS means that even if the attacker’s access is revoked, the payload remains active until manually removed.
PoC payload: "><script></script><img src=x onerror=alert(777)>

____

Risks:

1. Account Compromise: Attackers can steal session cookies, leading to unauthorized access.
2. Data Theft: Sensitive information from forms or sessions can be harvested.
3. Website Defacement: Injected scripts could modify page content to display malicious or misleading information.
4. Reputation Damage: Visitors exposed to malicious scripts may lose trust in the website.

Recommendations for Improved Security

To mitigate the risks associated with CVE-2024-13208, administrators should immediately update the WP Google Map plugin to the latest version once a patch is released. It is also essential to ensure that all user input, particularly those in fields like “Marker Description,” is properly sanitized and validated before being saved or rendered. Disabling the unfiltered_html capability for non-admin users, especially for contributors, will help prevent malicious scripts from being injected into plugin settings.

Additionally, implementing Content Security Policies (CSP) can block the execution of untrusted scripts, reducing the impact of any successful XSS attack. Regular security audits, the use of security plugins, and proper user role management can also help detect and mitigate vulnerabilities before they can be exploited. To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-13208, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #Vulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.