CVE-2024-13352
📋 TL;DR
The Legull WordPress plugin through version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability where unsanitized user input is reflected back in page output. This allows attackers to inject malicious scripts that execute in the browser of high-privilege users like administrators. WordPress sites using vulnerable versions of the Legull plugin are affected.
💻 Affected Systems
- Legull WordPress Plugin
📦 What is this software?
Legull by Alwayscurious
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator session cookies, perform actions as the administrator (like installing backdoors or creating new admin accounts), or redirect users to malicious sites.
Likely Case
Attackers would typically use this to steal session cookies or credentials from administrators who click on crafted malicious links.
If Mitigated
With proper web application firewalls and input validation, the risk is reduced to minimal impact with potential detection of attack attempts.
🎯 Exploit Status
Exploitation requires crafting malicious URLs and social engineering to get high-privilege users to click them. No authentication bypass is needed to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.2.2
Vendor Advisory: https://wpscan.com/vulnerability/2c141cc0-f79e-42bd-97a6-98829647104c/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Legull plugin and update to latest version. 4. If update not available, deactivate and remove the plugin.
🔧 Temporary Workarounds
Web Application Firewall Rule
allImplement WAF rules to block XSS payloads in query parameters
Input Validation Filter
wordpressAdd custom input sanitization for WordPress query parameters
add_filter('query_vars', 'sanitize_legull_params');
🧯 If You Can't Patch
- Disable or remove the Legull plugin completely
- Implement strict Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Legull version 1.2.2 or earlierCheck Version:
wp plugin list --name=legull --field=versionVerify Fix Applied:
Verify Legull plugin version is higher than 1.2.2 in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual query parameters containing script tags or JavaScript in WordPress access logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests with suspicious parameters containing <script> tags or JavaScript code
SIEM Query:
source="wordpress.log" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=")