CVE-2024-4608

Executive Summary

CVE-2024-4608 is a Stored Cross-Site Scripting (XSS) vulnerability in the SellKit – Funnel builder and checkout optimizer for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 1.9.8, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the id parameter. This vulnerability is due to insufficient input sanitization and output escaping. Successful exploitation can lead to session hijacking, credential theft, or defacement of WordPress sites. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authentication but can lead to significant client-side attacks.

Deep Dive & Mechanics

The vulnerability resides in the SellKit plugin's handling of the id parameter. When processing this parameter, the plugin fails to properly sanitize user input and escape output before rendering it in the page. An authenticated attacker with contributor-level access can craft a malicious payload containing JavaScript code. This payload is stored in the WordPress database (e.g., in post meta or plugin settings) and executed when any user, including administrators, views the affected page. The attack vector is Stored XSS, meaning the malicious script persists across sessions.

The id parameter is likely used in shortcodes or AJAX endpoints to fetch or display funnel data. Without proper validation, an attacker can inject script tags or event handlers. The lack of output escaping means the injected code is rendered as HTML/JavaScript rather than being neutralized.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.9.8):

// Example vulnerable function
function sellkit_display_funnel($atts) {
    $id = $atts['id'];
    // No sanitization or escaping
    echo "<div data-funnel-id='$id'>Funnel Content</div>";
}

Patched Code (Hypothetical):

function sellkit_display_funnel($atts) {
    $id = intval($atts['id']); // Sanitize to integer
    $id_esc = esc_attr($id);   // Escape for HTML attribute
    echo "<div data-funnel-id='$id_esc'>Funnel Content</div>";
}

The patch would involve using intval() or sanitize_text_field() on the id parameter and esc_attr() or esc_html() when outputting. Since no official patch is available, users must apply manual mitigations.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with SellKit plugin <= 1.9.8
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to a page or post editor where the SellKit shortcode is used (e.g., [sellkit_funnel id="123"]).
3. Modify the id parameter to inject a malicious payload:

   [sellkit_funnel id="123\" onmouseover=\"alert('XSS')\""]
   

4. Save the page/post.
5. When an administrator or other user views the page, the script executes.

Alternative Payload (Stored XSS via AJAX):

// Payload to steal cookies
fetch('/wp-admin/admin-ajax.php?action=sellkit_save&id=1&data='+document.cookie)

Blue Team

Detection:

• Monitor for unusual id parameter values in SellKit shortcodes or AJAX requests.
• Look for patterns like onload=, onerror=, <script>, or javascript: in post content or meta fields.
• Use Web Application Firewall (WAF) rules to block XSS payloads in the id parameter.

Hunting:

• Query the WordPress database for posts containing [sellkit_funnel with suspicious id values.
• Check wp_postmeta for meta keys related to SellKit that contain script tags.

Mitigation:

• Disable the SellKit plugin until a patch is released.
• Apply a virtual patch via WAF to sanitize the id parameter.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/sellkit/ (entire plugin directory)
• Database Entries: Posts or post meta containing [sellkit_funnel id="..."] with script tags or event handlers.
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs: PHP error logs showing unexpected characters in id parameter.
• Hashes (Plugin v1.9.8):
  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detection Engineering

YARA Rule

rule CVE_2024_4608_SellKit_XSS {
    meta:
        description = "Detects SellKit plugin files with potential XSS payloads"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-4608"
    strings:
        $xss_payload = /[sellkit_funnel\s+id\s*=\s*["'][^"']*?(?:<script|on\w+=|javascript:)/i
        $vuln_func = /echo\s+["'][^"']*\$id["']/i
    condition:
        $xss_payload or $vuln_func
}

Sigma Rule

title: CVE-2024-4608 SellKit Stored XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via SellKit plugin id parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/'
        cs-uri-query|contains: 'sellkit'
        cs-uri-query|re: '(?:<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in content
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4608 SellKit Stored XSS Attempt"; flow:to_server,established; content:"/wp-admin/"; http_uri; content:"sellkit"; http_uri; pcre:"/(?:<script|on\w+=|javascript:)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the SellKit plugin until an official patch is released.
2. Apply a virtual patch using a WAF to block XSS payloads in the id parameter.
3. Review and clean any existing posts or pages containing SellKit shortcodes for malicious content.

Long-term Fix:

• Monitor the SellKit plugin repository for a patched version (>= 1.9.9).
• Update the plugin as soon as a fix is available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Restrict contributor-level access to only trusted users.
• Use a security plugin (e.g., Wordfence) to add input sanitization rules.

Valters IT – DevSecOps & Cyber Threat Intelligence