CVE-2024-13314 – Carousel, Slider, Gallery by WP Carousel – Stored XSS to JS Backdoor Creation – POC

The WP Carousel plugin is a popular WordPress plugin that allows users to create beautiful image, post, and WooCommerce product carousels effortlessly. With its user-friendly interface and extensive features, it has become a preferred choice for many WordPress site owners. However, a vulnerability (CVE-2024-13314) has been discovered in versions below 2.7.4, allowing attackers to exploit Stored Cross-Site Scripting (XSS), posing a significant security risk.

CVE	CVE-2024-13314
Plugin	Carousel, Slider, Gallery by WP Carousel < 2.7.4
Critical	Medium
All Time	1 665 040
Active installations	60 000+
Publicly Published	January 31, 2024
Last Updated	January 31, 2024
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://wpscan.com/vulnerability/ae234bbe-a4af-49f5-8e0a-4fb960821e05/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13314
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

During security analysis, researchers identified a Stored XSS vulnerability in WP Carousel versions prior to 2.7.4. The issue arises when users upload an image and insert a malicious payload into the Description field. The payload is then stored in the database and executed when another user hovers over the edit icon in the plugin’s admin interface.

Understanding of XSS attack’s

Stored XSS occurs when an attacker injects malicious JavaScript into a web application, which is then stored in the database and executed when a legitimate user accesses the affected component.

In an e-commerce WordPress site using WP Carousel to showcase products, an attacker could inject a malicious script into the image description. When an administrator or another user interacts with the carousel settings, the script executes, potentially stealing cookies, redirecting users, or injecting more malware.

Exploiting the XSS Vulnerability

Exploiting CVE-2024-13314 requires access to the WP Carousel plugin’s marker management interface. Here’s how an attacker can exploit it:

1. Navigate to the WP Carousel plugin tab in the WordPress admin panel.
2. Add a new carousel.
3. Select “Image” as the Source Type and upload a photo.
4. Insert the malicious payload in the Description field during the upload process.
5. The payload executes upon hovering over the edit icon.

POC:

333"test=' onmouseover=alert(779) test=' //

____

Risks:

1. Account Compromise: Attackers can steal session cookies, leading to unauthorized access.
2. Data Theft: Sensitive information from forms or sessions can be harvested.
3. Website Defacement: Injected scripts could modify page content to display malicious or misleading information.
4. Reputation Damage: Visitors exposed to malicious scripts may lose trust in the website.

Recommendations for Improved Security

To mitigate the risk of Stored XSS vulnerabilities, follow these best practices:

1. Update the WP Carousel Plugin: Ensure you are running the latest version (2.7.4 or later).
2. Input Validation and Sanitization: Developers should sanitize and escape user inputs before storing them in the database.
3. Use Security Plugins: Install WordPress security plugins that monitor and block XSS attempts.
4. Restrict User Permissions: Limit administrative privileges to trusted users.
5. Enable Content Security Policy (CSP): Prevent execution of unauthorized scripts.
6. Regular Security Audits: Periodically check for vulnerabilities in installed plugins and themes.

Additionally, implementing Content Security Policies (CSP) can block the execution of untrusted scripts, reducing the impact of any successful XSS attack. Regular security audits, the use of security plugins, and proper user role management can also help detect and mitigate vulnerabilities before they can be exploited. To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-13208, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #Vulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.