One of the latest vulnerabilities discovered is CVE-2024-7955, discovered in the popular Starbox plugin. This preserved XSS vulnerability poses a serious danger because it allows attackers to inject malicious scripts into a website, which could potentially lead to a complete account hijacking. In this article, we will take a detailed look at this vulnerability, its consequences, and the steps you can take to protect your WordPress site.
| CVE | CVE-2024-7955 |
| Plugin | Starbox < 3.5.2 |
| Critical | Low |
| All Time | 477 585 |
| Active installations | 30 000+ |
| Publicly Published | August 1, 2024 |
| Last Updated | August 1, 2024 |
| Researcher | Artyom Krugov |
| OWASP TOP-10 | A7: Cross-Site Scripting (XSS) |
| PoC | Yes |
| Exploit | No |
| Reference | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7955/ https://wpscan.com/vulnerability/cbfcbe57-553d-490a-b7f3-48aa0022f63d/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
Timeline
| August 6, 2024 | Plugin testing and vulnerability detection in the Starbox have been completed |
| August 6, 2024 | I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing |
| August 23, 2024 | Registered CVE-2024-7955 |
Discovery of the Vulnerability
The vulnerability in the Starbox plugin was identified during routine security testing. The plugin, widely used for adding author boxes to posts, was found to have a critical flaw in its settings panel. Specifically, the parameters abh_titlefontsize and abh_descfontsize were vulnerable to Stored XSS attacks. This means that by exploiting these fields, an attacker could inject malicious scripts that would execute whenever the settings page or any page using these settings is loaded.
Understanding of Stored XSS attack’s
Stored Cross-Site Scripting (XSS) is a type of vulnerability where malicious scripts are injected into a web application and stored on the server. These scripts are then executed whenever a user visits the infected page. In the context of WordPress, Stored XSS can be particularly dangerous as it often leads to the execution of harmful code in the browser of anyone who views the affected content, including site administrators. This can result in unauthorized actions, such as changing settings, creating new admin accounts, or even stealing sensitive data.
Exploiting the Stored XSS Vulnerability
To exploit the CVE-2024-7955 vulnerability, an attacker needs to follow these steps:
POC:
Access the StarBox Plugin Settings:
- Log in to your WordPress admin dashboard.
- Navigate to the StarBox plugin settings panel.
Modify Vulnerable Parameters:
- Within the settings panel, locate the fields for
abh_titlefontsizeandabh_descfontsize.- These fields are used to adjust the font sizes for the title and description in the author box.
Inject the Malicious Payload:
- In either or both of the
abh_titlefontsizeandabh_descfontsizefields, input the following malicious script:1"test=' onmouseover=alert(779) test=' //____
The risks associated with this vulnerability are high, primarily because it can be used to create a backdoor into the admin account of a WordPress site. Once exploited, an attacker could potentially take over the entire site, steal sensitive user data, and spread the attack further to visitors of the site.
Recommendations for Improved Security
To mitigate this vulnerability and enhance overall site security, it is recommended that:
- Hijack Administrator Accounts: By executing malicious scripts, attackers can steal session tokens or cookies, allowing them to take over administrator accounts.
- Compromise User Data: Accessing admin privileges could lead to unauthorized access to sensitive user data stored within the WordPress site.
- Spread Malware: The attacker can inject additional scripts to distribute malware to site visitors, leading to a broader security breach.
- Damage Reputation: A compromised site can suffer significant reputational damage, leading to loss of trust among users and visitors.
By taking proactive measures to address XSS vulnerabilities like CVE-2024-7955, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.
#WordPressSecurity #XSS #WebsiteSafety #StayProtected #VeryHighVulnerability
Use CleanTalk solutions to improve the security of your website
ARTYOM K.
