CVE-2024-51676

Executive Summary

CVE-2024-51676 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Delisho (dr-widgets-blocks) by WP Delicious, affecting versions up to and including 1.0.6. The vulnerability stems from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser within the context of the WordPress site. This can lead to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and no public exploit or patch is currently available. The plugin is part of the WordPress ecosystem and should not be confused with server-level software like Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the lack of a patch and the potential for DOM-based attacks that bypass traditional server-side filters.

Deep Dive & Mechanics

The vulnerability exists in the dr-widgets-blocks component of the Delisho plugin. DOM-Based XSS occurs when client-side JavaScript processes user input (e.g., from document.location, document.URL, or window.name) and injects it into the DOM without proper sanitization. In this case, the plugin likely reads data from the URL fragment or query string and writes it directly to the page using innerHTML or similar methods, allowing an attacker to craft a malicious link that executes arbitrary JavaScript.

The attack does not require server-side interaction; the payload is executed entirely in the browser. This makes it difficult for traditional WAFs to detect, as the malicious input never reaches the server.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

// dr-widgets-blocks.js (v1.0.6)
var userInput = window.location.hash.substring(1);
document.getElementById('widget-content').innerHTML = userInput;

Patched Code (recommended):

// dr-widgets-blocks.js (patched)
var userInput = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(userInput);
document.getElementById('widget-content').textContent = sanitized;

The patched version uses textContent instead of innerHTML and applies DOMPurify for defense-in-depth.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Delisho plugin <= 1.0.6
• Victim user with browser access

Exploit Steps:

1. Craft a malicious URL:

   https://victim-site.com/#<img src=x onerror=alert('XSS')>
   

2. Encode the payload if needed:

   https://victim-site.com/#%3Cimg%20src=x%20onerror=alert('XSS')%3E
   

3. Deliver the link via phishing email or social engineering.
4. When the victim clicks the link, the script executes in their browser.

No public exploit code is available.

Blue Team

Detection:

• Monitor for unusual URL fragments containing script tags or event handlers.
• Use browser-based CSP headers to mitigate XSS.
• Deploy client-side XSS filters.

Hunting:

• Search web server logs for requests with # followed by suspicious patterns.
• Use browser console monitoring extensions.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing #<script or #<img in the URL fragment.
• Host: Presence of dr-widgets-blocks.js in /wp-content/plugins/delisho/ with version <= 1.0.6.
• Behavior: Unexpected DOM modifications or alert dialogs on WordPress pages.

Detection Engineering

YARA Rule

rule CVE_2024_51676_DOM_XSS {
    meta:
        description = "Detects Delisho plugin files vulnerable to DOM XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51676"
    strings:
        $vuln_func = "innerHTML" nocase
        $plugin_file = "dr-widgets-blocks.js" nocase
    condition:
        $plugin_file and $vuln_func
}

Sigma Rule

title: CVE-2024-51676 DOM XSS in Delisho Plugin
id: 8a3f2c1e-5d7b-4a9f-8c2e-1b3d5f7a9c0e
status: experimental
description: Detects potential DOM XSS via URL fragment in Delisho plugin
author: Valters IT
logsource:
    category: web
    product: wordpress
detection:
    selection:
        cs-uri-query|contains: '#'
        cs-uri-query|re: '(<|%3C)(script|img|iframe|svg)'
    condition: selection
falsepositives:
    - Legitimate use of URL fragments
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51676 DOM XSS Attempt"; flow:to_server,established; content:"#"; http_uri; pcre:"/(<|%3C)(script|img|iframe|svg)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Delisho plugin until a patch is released.
2. Implement a Content Security Policy (CSP) with script-src 'self' to block inline scripts.
3. Use a Web Application Firewall (WAF) with rules to detect DOM-based XSS patterns.

Long-Term Fix:

• The vendor must release a patched version that sanitizes user input before DOM insertion.
• Users should monitor the WordPress plugin repository for updates.

Workarounds:

• Replace the plugin with an alternative if possible.
• Manually patch the JavaScript file by replacing innerHTML with textContent and adding DOMPurify.

Valters IT
Securing Digital Frontiers