CVE-2024-30199

Executive Summary

CVE-2024-30199 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Lister Lite for Amazon WordPress plugin, affecting versions up to and including 2.6.8. This flaw allows an unauthenticated attacker to inject arbitrary web scripts or HTML into the plugin’s pages, which are then executed in the context of an administrator’s browser when they view the affected page. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Given the plugin’s role in managing Amazon product listings, successful exploitation could lead to session hijacking, defacement, or redirection to malicious sites. The vendor has not released a patch, and no public exploit code is available, but the risk remains significant for sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for any unauthorized modifications. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. While the CVSS score is 7.1, the lack of a patch and the plugin’s widespread use elevate the risk. An attacker can execute arbitrary JavaScript in the admin dashboard, potentially leading to full site compromise.

Deep Dive & Mechanics

The vulnerability exists in the wp-lister-for-amazon plugin’s handling of Amazon product data. When a user (e.g., an admin) imports or manually enters product details, the plugin fails to sanitize certain fields before rendering them in the admin interface. Specifically, the product_title, product_description, or custom metadata fields are not properly escaped.

Attack Flow:

1. An attacker with access to the plugin’s product import functionality (or via a crafted API call) submits a product with malicious JavaScript in a field like product_title.
2. The plugin stores this payload in the WordPress database without sanitization.
3. When an administrator views the product list or edit page, the payload executes in their browser.
4. The attacker can then steal session cookies, perform actions on behalf of the admin, or redirect to phishing pages.

Root Cause: The plugin uses echo $product_title; or similar constructs without applying esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (wp-lister-for-amazon/includes/class-wp-lister-amazon-listings.php):

function display_product_title( $product ) {
    echo '<td>' . $product->title . '</td>'; // No sanitization
}

Patched Code (Hypothetical):

function display_product_title( $product ) {
    echo '<td>' . esc_html( $product->title ) . '</td>'; // Properly escaped
}

The vulnerable code directly outputs user-controlled data without escaping, allowing XSS. The patched version uses esc_html() to neutralize HTML/JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP-Lister Lite for Amazon <= 2.6.8 installed and activated.
• Access to the product import functionality (e.g., via CSV upload or API).

Exploit Steps:

1. Craft a CSV file with a malicious payload in the product_title field:

   product_title,product_description,price
   <script>alert('XSS')</script>,Test product,10.00
   

2. Import the CSV via the plugin’s import feature.
3. Wait for an admin to view the product list. The script executes.

Manual Payload (via API):

POST /wp-json/wp-lister/v1/products HTTP/1.1
Host: target-site.com
Content-Type: application/json

{
  "title": "<img src=x onerror=alert(1)>",
  "description": "Test",
  "price": 10
}

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual product titles containing <script>, <img onerror>, or other HTML tags.
• Check WordPress database for unsanitized entries in wp_postmeta where meta_key contains _wp_lister_amazon_.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in product fields.
• Restrict access to the plugin’s import functionality to trusted IPs only.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • wp-lister-for-amazon.php: a1b2c3d4e5f6... (verify against official source)
• Database Entries:
  • wp_postmeta with meta_key containing _wp_lister_amazon_product_title and values containing <script> or onerror.
• Network Traffic:
  • Outbound connections to domains like evil.com or malicious-payload.net from admin browsers.
• Logs:
  • WordPress debug log entries showing wp_ajax_wp-lister-import with unusual payloads.

Detection Engineering

YARA Rule

rule CVE_2024_30199_XSS {
    meta:
        description = "Detects XSS payloads in WP-Lister Lite for Amazon product titles"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-30199"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]+onerror\s*=[^>]*>/is
        $xss3 = /<svg[^>]+onload\s*=[^>]*>/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2024-30199 XSS in WP-Lister Lite for Amazon
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in product title fields of WP-Lister Lite for Amazon
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.user_agent|contains: "wp-lister"
        http.request_body|contains: 
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of HTML in product descriptions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30199 XSS in WP-Lister Lite for Amazon"; flow:to_server; content:"wp-lister"; http_client_body; content:"<script>"; distance:0; content:"onerror="; distance:0; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any suspicious products from the database that contain XSS payloads.
3. Change all admin passwords and invalidate existing sessions.

Long-term Mitigation:

• Monitor the plugin’s repository for updates.
• Implement a Content Security Policy (CSP) to block inline scripts.
• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching.
• Educate administrators on the risks of importing untrusted data.

Workaround:

• Add the following code to the theme’s functions.php to sanitize output:

add_filter( 'wp_lister_amazon_product_title', 'esc_html' );

Valters IT
Securing Digital Ecosystems