CVE-2024-3703 – Carousel Slider – Editor+ Stored XSS – POC

In the digital landscape, vulnerabilities in software can lead to significant security risks. One such vulnerability, CVE-2024-3703, has been discovered in the Carousel Slider plugin for WordPress. This particular vulnerability, categorized as a Stored XSS (Cross-Site Scripting), can enable malicious actors to execute arbitrary code on behalf of contributors, potentially leading to account takeover and other malicious activities. This article delves into the discovery, exploitation, potential risks, and recommendations associated with this vulnerability. (if an attacker has previously hijacked an administrator or editor account, he can plant a backdoor to regain access back)

Main info:

CVE	CVE-2024-3703
Plugin	Carousel Slider < 2.2.10
Critical	High
All Time	894,599
Active installations	40 000+
Publicly Published	April 12, 2024
Last Updated	April 12, 2024
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3703 https://wpscan.com/vulnerability/3242b820-1da0-41ba-9f35-7be5dbc6d4b0/
Plugin Security Certification by CleanTalk

Timeline

Discovery of the Vulnerability

During the testing phase of the Carousel Slider plugin, security researchers identified a vulnerability that allows for the implementation of Stored XSS. This vulnerability occurs when an attacker embeds malicious script into certain parameters within the plugin’s interface. By exploiting this vulnerability, attackers can execute unauthorized actions on the WordPress site, posing a serious threat to its security and integrity.

Understanding of Stored XSS attack’s

Stored XSS, or Persistent XSS, is a type of Cross-Site Scripting attack where the malicious script is injected into the web application’s database or another data store. When the vulnerable page is accessed by a user, the script executes in the user’s browser, often leading to unauthorized actions or data theft.

Exploiting the Stored XSS Vulnerability

To exploit the Stored XSS vulnerability in the Carousel Slider plugin, attackers can follow a series of steps within the plugin’s interface. By manipulating specific parameters, such as the slider padding settings, attackers can inject malicious payloads that will execute when other users interact with the affected slider. This allows attackers to execute arbitrary code in the context of the victim’s session, potentially leading to account takeover or other malicious activities

POC:

1. Click Add New
2. Any name and select Hero Carousel
3. Vulnerable Slider Padding parameters
4. Requests are intercepted in these parameters through the Burp Suite tool
5. Enter Shortcode with id from Editor.

Enter the payload into the parameters: content_settings[slide_padding][top]=”onmouseover=’alert(1)’

___

The exploitation of CVE-2024-3703 poses significant risks to WordPress sites using the Carousel Slider plugin. With the ability to execute arbitrary code in the context of contributor accounts, attackers can perform various malicious actions

Recommendation

To mitigate the risks associated with CVE-2024-3703 and similar vulnerabilities, WordPress site administrators and developers should take the following measures:

• Update the Carousel Slider plugin to the latest patched version to mitigate the vulnerability.
• Regularly monitor and audit plugins and themes for security vulnerabilities.
• Implement proper input validation and output sanitization techniques to prevent XSS attacks.
• Educate contributors and users about the risks of XSS vulnerabilities and the importance of secure coding practices.
• Employ security plugins and web application firewalls to detect and block malicious activities.

Stay vigilant and proactive in safeguarding your WordPress site against emerging threats like CVE-2024-3703. Your website’s security is paramount, so take action now to prevent potential exploitation.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

ARTYOM K.