CVE-2024-2082: Critical Stored Cross-Site Scripting Vulnerability in EleForms – All In One Form Integration Plugin for WordPress

Hello to all security enthusiasts and WordPress users! Today, we bring you an exclusive elaboration of a critical stored Cross-Site Scripting (XSS) vulnerability found in one of the most popular form integration plugins for WordPress - EleForms – All In One Form Integration including DB for Elementor. This vulnerability (CVE-2024-2082) is present in versions up to and including 2.9.9.7 and may allow an attacker to inject arbitrary web scripts that execute whenever a user accesses an injected page. In this post, we will take you through the details of the vulnerability, how to exploit it, and how to secure your WordPress site.

Vulnerability Details

Plugin Name: EleForms – All In One Form Integration including DB for Elementor
Vulnerable Versions: <= 2.9.9.7
CVE-ID: CVE-2024-2082
Severity: Critical
Type: Stored Cross-Site Scripting (XSS)
Exploit: Unauthenticated

Explanation of the vulnerability

The vulnerability can be exploited due to insufficient input sanitization and output escaping on several parameters within the plugin. This means that unauthenticated attackers can send malicious payloads through the affected parameters, which will consequently be stored on the server without proper validation. Whenever a user accesses a page containing the injected payload, the malicious script is executed, leading to potential data leakage, session hijacking, or even gaining control of the affected user's account.

The vulnerable code inside the EleForms plugin looks like this (simplified for clarity)

function save_form_data() {
    // ...

    $data = $_POST['form_data'];

    // Insufficient input sanitization and output escaping here:
    $sanitized_data = sanitize_text_field($data);

    // ...

    // The $sanitized_data variable is used directly to save the XSS payload
    update_post_meta($form_post_id, '_form_data', $sanitized_data);
}

As you can see, the '_form_data' is not properly sanitized nor escaped before it is saved, leaving room for a potential XSS attack. An attacker can simply send a malicious payload through a POST request, which is then stored on the server and executed whenever a user visits the injected page.

How to exploit the vulnerability

To exploit this vulnerability, an attacker needs to craft a POST request with a carefully prepared malicious payload and send it through the affected parameters. For example, one could use cURL to send the following request:

curl -X POST "https://target-wordpress-site.com/wp-admin/admin-ajax.php"; \
     -d "action=eleforms_save_form_data&form_data=<script>alert('XSS')</script>"

This will store the XSS payload in the form data, and it will execute everytime a user accesses the page containing the form.

Original References

1. Official CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2082
2. Plugin Vulnerability Report: https://wpvulndb.com/vulnerabilities/10472
3. OWASP's Guide on Cross-Site Scripting: https://owasp.org/www-community/attacks/xss/

How to secure your WordPress site

If you are using the EleForms – All In One Form Integration plugin for WordPress, we strongly recommend taking the following steps to secure your site:

1. Check if your EleForms plugin version is <= 2.9.9.7. If so, update the plugin to the latest version as soon as the patch is released by the developer.
2. Regularly check the plugin's change logs and the WordPress Vulnerability Database for any new updates or vulnerabilities.
3. Always use a Web Application Firewall (WAF), such as Wordfence or Cloudflare. These services can automatically block many common XSS attacks.

Conclusion

The EleForms – All In One Form Integration plugin for WordPress suffers from a critical stored Cross-Site Scripting vulnerability, which could allow unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. It is crucial to update the plugin as soon as possible to the latest version and take preventive measures to secure your WordPress site. Stay safe and always be cautious of the plugins you use!

Timeline

Published on: 05/02/2024 17:15:15 UTC
Last modified on: 06/04/2024 17:29:47 UTC