Description

CVE-2024-10584 affects the DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress, allowing for Stored Cross-Site Scripting (XSS) via SVG File uploads. This vulnerability arises from insufficient input sanitization and output escaping, enabling authenticated attackers with author-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the SVG file. Notably, if DirectoryPress Frontend is installed, unauthenticated users could potentially exploit this vulnerability. While the CVSS score is 5.4, SOCRadar's SVRS score is 46, indicating a moderate level of risk requiring attention.

Key Insights

• Impact: Successful exploitation of CVE-2024-10584 can lead to the execution of arbitrary JavaScript code in the context of the affected website. This could allow attackers to steal sensitive information like user credentials, hijack user accounts, redirect users to malicious websites, or deface the website.
• Vulnerability: The vulnerability lies in the plugin's handling of SVG file uploads. It fails to properly sanitize and escape user-supplied input, permitting attackers to embed malicious JavaScript code within the SVG files.
• Exploitation: Although there is no evidence of active exploitation in the wild, the vulnerability could be easily exploited by attackers with knowledge of the plugin's codebase.
• Attackers: While no specific Threat Actors/APT Groups are currently associated with this vulnerability, it could be exploited by various actors, including script kiddies, cybercriminals, and nation-state actors.

Mitigation Strategies

• Update Plugin: Immediately update the DirectoryPress plugin to version 3.6.17 or later. This patch addresses the vulnerability and ensures proper input sanitization and output escaping.
• Disable SVG Uploads: If you do not require SVG file uploads, disable this functionality in the plugin settings as a temporary mitigation measure while updating.
• Web Application Firewall (WAF): Implement a WAF to detect and block potential XSS attacks. This adds an extra layer of security by filtering malicious requests before they reach the website.
• Security Monitoring: Regularly monitor your website for suspicious activity and signs of compromise. This includes analyzing website logs, monitoring user activity, and proactively searching for signs of malware or suspicious code.

Additional Information:

If you have further questions about this incident, utilize the 'Ask to Analyst' feature, reach out to SOCRadar directly, or open a support ticket for detailed information.