CVE-2024-29143 in Passwordless Login Plugin
Summary
by MITRE • 03/19/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs, sareiodata Passwordless Login passwordless-login allows Stored XSS.This issue affects Passwordless Login: from n/a through 1.1.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2025
The CVE-2024-29143 vulnerability represents a critical cross-site scripting flaw in the Cozmoslabs sareiodata Passwordless Login plugin, specifically impacting versions through 1.1.2. This stored cross-site scripting vulnerability occurs during web page generation when input data is improperly neutralized, creating a persistent security risk for users of the passwordless authentication system. The vulnerability stems from insufficient validation and sanitization of user-supplied data that gets stored and subsequently rendered in web pages without proper escaping mechanisms.
The technical flaw manifests when malicious input is accepted and stored within the plugin's database or configuration structures, then later retrieved and displayed in web interfaces without adequate output encoding or sanitization. This allows attackers to inject malicious scripts that execute in the context of other users' browsers, potentially enabling session hijacking, credential theft, or other malicious activities. The stored nature of this XSS vulnerability means that the malicious payload persists even after the initial injection, making it particularly dangerous as it can affect multiple users over time.
The operational impact of this vulnerability extends beyond simple script execution, as it can facilitate more sophisticated attacks within the compromised environment. Attackers can leverage this flaw to steal user sessions, modify data, redirect users to malicious sites, or even escalate privileges within the WordPress environment where the plugin operates. The vulnerability affects the core authentication functionality of the passwordless login system, potentially undermining the security assurances that users expect from passwordless authentication methods. This issue represents a significant risk to user privacy and system integrity, particularly in environments where the plugin handles sensitive authentication data.
Security mitigations for this vulnerability should focus on implementing comprehensive input validation and output sanitization measures throughout the plugin's codebase. The recommended approach includes adopting proper HTML escaping techniques for all user-supplied content before rendering in web interfaces, implementing Content Security Policy headers to limit script execution, and conducting thorough code reviews to identify all potential input vectors. Organizations should immediately update to the latest version of the plugin where this vulnerability has been patched, and implement monitoring for suspicious activities that might indicate exploitation attempts. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and represents a technique commonly categorized under ATT&CK tactic TA0001 (Initial Access) and technique T1190 (Exploit Public-Facing Application) in the MITRE ATT&CK framework, highlighting its potential for unauthorized system access through web application exploitation.