CVE-2024-51795

Executive Summary

CVE-2024-51795 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Pdf Embedder Fay" by Fayjur, affecting versions up to and including 1.10.1. The vulnerability stems from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The CVSS score is 6.5 (Medium), and no public exploit or patch is currently available. This vulnerability is specific to the WordPress ecosystem and does not involve server-level components like Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. Since no patch is available, the supply chain risk is elevated, as users must rely on manual mitigation or removal of the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is medium due to the requirement for user interaction (e.g., clicking a crafted link) and the limited impact on confidentiality, integrity, and availability. However, DOM-based XSS can be leveraged for more severe attacks, such as session hijacking or credential theft.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS, meaning the payload is executed entirely on the client side without involving the server. The plugin likely processes user input (e.g., via URL parameters or JavaScript variables) and injects it into the DOM without proper sanitization. An attacker can craft a malicious URL that, when visited by a logged-in administrator, executes arbitrary JavaScript in the context of the WordPress admin panel.

The attack flow:

1. Attacker crafts a URL containing a malicious payload (e.g., #<script>alert(1)</script>).
2. Victim (e.g., an admin) clicks the link.
3. The plugin's JavaScript reads the fragment identifier or other input and inserts it into the DOM.
4. The injected script executes, allowing the attacker to steal cookies, modify pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern. The vulnerable code likely resembles:

// Vulnerable code in pdf-embedder-fay plugin
var userInput = window.location.hash.substring(1);
document.getElementById('pdf-container').innerHTML = userInput;

A patched version would sanitize the input before DOM insertion:

// Patched code
var userInput = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(userInput);
document.getElementById('pdf-container').innerHTML = sanitized;

Exploitation & Lab Setup

Red Team

To exploit this vulnerability in a lab environment:

1. Install WordPress with the Pdf Embedder Fay plugin (version 1.10.1).
2. Craft a malicious URL:

   http://target-site/wp-admin/admin.php?page=pdf-embedder-fay#<img src=x onerror=alert(document.cookie)>
   

3. Send the link to a logged-in admin user.
4. Upon clicking, the XSS payload executes, revealing the admin's session cookie.

Blue Team

To detect exploitation attempts:

1. Monitor web server logs for unusual URL fragments containing <script>, <img onerror>, or other XSS patterns.
2. Use browser-based security headers (e.g., Content-Security-Policy) to mitigate impact.
3. Deploy a Web Application Firewall (WAF) rule to block requests with suspicious fragment identifiers.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing #<script>, #<img, #<svg, or other HTML tags in the fragment identifier.
• Client-Side Artifacts: JavaScript execution of alert(), document.cookie, or fetch() to external domains.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2024_51795_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS payloads targeting Pdf Embedder Fay plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51795"
    strings:
        $payload1 = /#<script[^>]*>/
        $payload2 = /#<img[^>]*onerror/
        $payload3 = /#<svg[^>]*onload/
    condition:
        any of them
}

Sigma Rule

title: DOM-Based XSS Attempt Against Pdf Embedder Fay
id: 8a3f2c1d-5e7b-4a9f-8c6d-2e1f3a4b5c6d
status: experimental
description: Detects HTTP requests with XSS payloads in the URL fragment targeting the Pdf Embedder Fay plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
    condition: selection
falsepositives:
    - Legitimate use of HTML fragments in URLs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51795 DOM-Based XSS in Pdf Embedder Fay"; flow:to_server; content:"#<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-51795 DOM-Based XSS in Pdf Embedder Fay"; flow:to_server; content:"#<img"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-51795 DOM-Based XSS in Pdf Embedder Fay"; flow:to_server; content:"#<svg"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Disable the plugin until a patch is released.
2. Implement Content Security Policy (CSP) headers to block inline scripts.
3. Use a Web Application Firewall (WAF) to filter malicious URL fragments.
4. Educate users not to click on suspicious links, especially those with unusual fragment identifiers.
5. Monitor for updates from the plugin vendor and apply patches immediately when available.

Valters IT
Securing Digital Frontiers