CVE-2024-1401 – Profile Box Shortcode And Widget – Stored XSS to backdoor creation – POC

A critical security vulnerability has been identified in the “Profile Box Shortcode And Widget” plugin for WordPress, marked as CVE-2024-1401. This flaw enables attackers to execute malicious scripts and potentially create backdoors through the plugin’s functionality. In this article, we delve into the discovery of the vulnerability, understand the implications of Stored XSS in WordPress, explore the exploitation process, discuss potential risks and real-world scenarios, and conclude with recommendations for enhanced security measures. As a result, high privilege users such as administrators can exploit this flaw to execute malicious scripts, potentially leading to account takeover (if an attacker has previously hijacked an administrator or editor account, he can plant a backdoor to regain access back).

Main info:

CVE	CVE-2024-1401
Plugin	Profile Box Shortcode And Widget < 1.2.1
Critical	High
All Time	238 922
Active installations	4 000+
Publicly Published	February 20, 2023
Last Updated	February 20, 2023
Researcher	Dmtirii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1401 https://wpscan.com/vulnerability/91064ba5-cf65-46e6-88df-0e4d96a3ef9f/
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

During routine testing of the plugin, security researchers identified a vulnerability that allows malicious actors to inject and execute arbitrary JavaScript code via the plugin’s widget. Specifically, the flaw enables the execution of Stored XSS attacks when certain input fields are manipulated.

Understanding of Stored XSS attack’s

Stored Cross-Site Scripting (XSS) is a type of vulnerability that allows attackers to inject malicious scripts into web applications. In the context of WordPress, Stored XSS occurs when user-supplied data is not properly sanitized and is subsequently displayed on web pages, allowing attackers to execute scripts in the context of unsuspecting users.

Real-world examples of Stored XSS vulnerabilities in WordPress include injecting malicious scripts into comments, form fields, or plugin settings. Once executed, these scripts can perform various malicious actions, such as stealing session cookies, redirecting users to phishing sites, or even compromising admin accounts.

Exploiting the Stored XSS Vulnerability

To exploit the vulnerability in the “Profile Box Shortcode And Widget” plugin, attackers can craft a payload containing malicious JavaScript code and inject it into specific input fields, such as the “Max width” field when creating a new widget. Once the widget is deployed on a WordPress page, unsuspecting users who interact with it may trigger the execution of the injected code, leading to a successful XSS attack.

POC:

When creating a new widget, insert the following payload in the "Max width" field - 250" onmouseover="alert(/XSS/)"

___

The exploitation of Stored XSS vulnerabilities poses significant risks to WordPress websites and their users. In the case of CVE-2024-1401, attackers could leverage the vulnerability to create backdoors within WordPress sites, allowing unauthorized access and potential data exfiltration.

Real-world scenarios of such attacks may involve the compromise of admin accounts, unauthorized data manipulation, or the injection of malicious content into web pages. Additionally, attackers could exploit the vulnerability to launch further attacks, such as spreading malware or conducting phishing campaigns.

Recommendations for Improved Security

To mitigate the risk associated with Stored XSS vulnerabilities like CVE-2024-1401, WordPress website administrators should take proactive security measures:

• Regularly update plugins and themes to patch known vulnerabilities.
• Implement input validation and output encoding to prevent XSS attacks.
• Utilize security plugins and tools to scan for and mitigate potential vulnerabilities.
• Educate users and administrators about best practices for secure coding and website management.
• Consider implementing Content Security Policy (CSP) headers to reduce the impact of XSS attacks.

By following these recommendations, website owners can enhance the security posture of their WordPress sites and protect against the exploitation of Stored XSS vulnerabilities like CVE-2024-1401.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

DMITRII I.