CVE-2024-43238

Executive Summary

CVE-2024-43238 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the weMail plugin for WordPress, developed by weDevs. The flaw affects all versions up to and including 1.14.5. An attacker can inject malicious scripts into the DOM of a victim's browser by exploiting improper neutralization of user input during web page generation. This vulnerability requires user interaction (e.g., clicking a crafted link) and can lead to session hijacking, credential theft, or defacement within the context of the victim's WordPress session. As of this report, no official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched installations.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The weMail plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions of the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. Although the EPSS score is low, the vulnerability is trivial to exploit once a victim interacts with a malicious link. The lack of a patch makes all installations of weMail <= 1.14.5 vulnerable.

Deep Dive & Mechanics

The vulnerability resides in the weMail plugin's JavaScript handling of user-supplied data. Specifically, the plugin fails to sanitize input that is later inserted into the DOM via innerHTML, document.write, or similar methods. An attacker can craft a URL containing a malicious payload (e.g., <img src=x onerror=alert(1)>) that, when processed by the plugin's JavaScript, executes in the victim's browser.

Root Cause: The plugin uses window.location.hash or document.URL to read parameters and directly injects them into the DOM without proper encoding or validation. This allows an attacker to control the DOM context and execute arbitrary JavaScript.

Attack Flow:

1. Attacker crafts a malicious link: https://victim-site.com/?page=wemail#<script>alert('XSS')</script>
2. Victim clicks the link while authenticated to WordPress.
3. The weMail plugin's JavaScript reads the hash fragment and inserts it into the page.
4. The browser executes the injected script, giving the attacker control over the victim's session.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable pattern and a hypothetical fix.

Vulnerable Code (JavaScript):

// Vulnerable: Directly using hash without sanitization
var hash = window.location.hash.substring(1);
document.getElementById('output').innerHTML = hash;

Patched Code (Hypothetical Fix):

// Patched: Use textContent or sanitize input
var hash = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(hash);
document.getElementById('output').textContent = sanitized;
// Or use textContent to prevent HTML injection
document.getElementById('output').textContent = hash;

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with weMail plugin version <= 1.14.5.
• A victim user with an active session.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., any page that loads weMail JavaScript).
2. Craft a malicious URL with a DOM-based XSS payload in the hash fragment:

   https://victim-site.com/wp-admin/admin.php?page=wemail#<img src=x onerror=alert(document.cookie)>
   

3. Send the link to the victim via phishing email or social engineering.
4. Once the victim clicks the link, the payload executes, and the attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection & Prevention:

• Monitor for unusual URL patterns containing <script>, <img onerror>, or other HTML/JavaScript tags in the hash fragment.
• Implement Content Security Policy (CSP) headers to block inline script execution.
• Use Web Application Firewall (WAF) rules to filter malicious payloads in URL fragments.
• Educate users about phishing links and the risks of clicking untrusted URLs.

Lab Setup:

• Use a local WordPress instance with weMail 1.14.5.
• Simulate the attack by crafting the malicious URL and observing the DOM changes via browser developer tools.
• Verify detection by checking server logs for requests containing suspicious hash fragments.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing #<script> or #<img in the hash fragment.
  • Outbound connections to attacker-controlled domains from the victim's browser.
• Host IOCs:
  • Unusual JavaScript execution in the browser console.
  • Unexpected DOM modifications (e.g., injected iframes, scripts).
• File IOCs:
  • Modified weMail plugin files (check file integrity via checksums).
  • Suspicious entries in WordPress wp_options or wp_postmeta tables.

Detection Engineering

YARA Rule

rule CVE_2024_43238_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS payloads targeting weMail plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-43238"
    strings:
        $payload1 = /#<script[^>]*>.*<\/script>/i
        $payload2 = /#<img[^>]*onerror[^>]*>/i
        $payload3 = /#<svg[^>]*onload[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-43238 weMail DOM XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with DOM XSS payloads in the URL fragment targeting weMail
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43238 weMail DOM XSS Attempt"; flow:to_server; content:"#<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-43238 weMail DOM XSS Attempt"; flow:to_server; content:"#<img"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-43238 weMail DOM XSS Attempt"; flow:to_server; content:"#<svg"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the weMail plugin until an official patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script>, <img onerror>, or similar patterns in the URL fragment.
3. Add Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Fix:

• Monitor the weDevs official channels for a patched version.
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins for similar DOM-based XSS vulnerabilities.

Workaround:

• If the plugin cannot be disabled, manually edit the JavaScript file to sanitize input using textContent instead of innerHTML, or use a library like DOMPurify.

Valters IT
Securing Digital Frontiers