CVE-2024-7082 – Easy Table of Contents – Stored XSS to backdoor creation – POC

A newly discovered vulnerability in the Easy Table of Contents WordPress plugin, designated as CVE-2024-7082, puts more than 500,000 sites at risk. This flaw allows attackers to exploit a Stored Cross-Site Scripting (XSS) vulnerability, which could lead to account takeovers and the installation of backdoors within a WordPress environment. The vulnerability primarily occurs due to the plugin’s failure to properly sanitize user inputs, enabling malicious JavaScript (JS) code to be injected into the site’s widget settings. Once exploited, this flaw can result in the execution of malicious scripts by unsuspecting administrators, giving attackers the opportunity to manipulate or control the website.

CVE	CVE-2024-7082
Plugin	Easy Table of Contents < 2.0.68
Critical	High
All Time	13 706 000
Active installations	500 000+
Publicly Published	August 19, 2024
Last Updated	August 19, 2024
Researcher	Dmitrii Ignatyev
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7082 https://wpscan.com/vulnerability/8f30e685-00fa-4dbb-b516-2d14e4b13697/
Plugin Security Certification by CleanTalk
Logo of the plugin

Timeline

Discovery of the Vulnerability

CVE-2024-7082 was identified during an assessment of the Easy Table of Contents plugin’s widget feature. During testing, it was found that the plugin’s “Title” field, intended for setting widget titles, could be manipulated to inject harmful JavaScript. A proof-of-concept (PoC) demonstrated that by modifying the “Title” field with a script such as 123" onmouseover=alert(1)//, the malicious payload would execute whenever the widget is hovered over. In this scenario, the vulnerability arises because the plugin does not properly filter or escape user inputs, allowing JavaScript code to be saved and later executed. This issue is particularly concerning as it affects WordPress admins and editors, who typically have permissions to use unfiltered HTML and JavaScript in their roles.

Understanding of Stored XSS attack’s

Cross-Site Scripting (XSS) vulnerabilities are one of the most common security flaws affecting web applications, including WordPress. They allow attackers to inject harmful scripts into web pages that unsuspecting users then execute in their browsers. In WordPress, XSS can be particularly dangerous due to the wide variety of plugins that extend the platform’s functionality. When plugins like Easy Table of Contents fail to properly sanitize user input, they create openings for attackers to introduce malicious scripts that can steal user credentials, hijack sessions, or execute unauthorized commands.

Exploiting the Stored XSS Vulnerability

Exploiting the CVE-2024-7082 vulnerability requires an attacker to gain access to a role with sufficient permissions, such as an editor or administrator. The attacker can then create or modify a widget in the Easy Table of Contents plugin and inject malicious code into the “Title” field. A simple PoC involves inserting a script like 123" onmouseover=alert(1)// into the field

POC:

Go to the widgets of the plugin and change "Title" field to "Malicious JS code eval() and etc. For example 123" onmouseover=alert(1)// -> Save Settings (Admins and editors are allowed to use JS in posts/pages/comments/etc, so the unfiltered_html capability should be disallowed when testing for Stored XSS using such roles)

____

The risk posed by CVE-2024-7082 is significant, given the widespread use of the Easy Table of Contents plugin across more than 500,000 websites. A successful exploitation could result in an attacker taking over the site’s administrative account, installing backdoors, and potentially causing long-lasting damage. Attackers could use compromised sites as a launching point for distributing malware, defacing the website, or stealing sensitive data such as user credentials and payment information. In addition, compromised WordPress sites could be used in broader campaigns to attack other sites or users.

Recommendations for Improved Security

To protect against CVE-2024-7082 and similar vulnerabilities, WordPress site administrators should follow a few key steps. First, they should ensure that all plugins, including Easy Table of Contents, are updated to the latest version, as developers often release patches to address security vulnerabilities. Plugin developers must implement rigorous input validation and ensure that all user-supplied data is properly sanitized and escaped. By doing so, the risk of XSS vulnerabilities can be significantly reduced.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-7082, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #VeryHighVulnerability

Use CleanTalk solutions to improve the security of your website

ARTYOM K.