CVE-2024-51880

Executive Summary

CVE-2024-51880 is a DOM-Based Cross-Site Scripting (XSS) vulnerability identified in the BeBetter Social Icons WordPress plugin, developed by Sistemasbebetter. The vulnerability affects all versions up to and including 2.7. It stems from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The attack vector is network-based, requires user interaction, and can lead to partial compromise of confidentiality, integrity, and availability. As of this report, no official patch is available, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are affected. The lack of a patch means that supply chain risk is elevated; users must rely on manual mitigation or removal of the plugin until a fix is released. No known malicious packages or typosquatting variants have been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click or interact with a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the DOM-based nature allows for stealthy attacks via crafted URLs or embedded content.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS (CWE-79) in the bebetter-social-icons plugin. Unlike reflected or stored XSS, DOM-based XSS occurs when client-side JavaScript processes user input from the URL fragment or query string and writes it to the DOM without proper sanitization. In this plugin, the vulnerable code likely reads parameters such as # or ? values and injects them into HTML elements (e.g., innerHTML or document.write). An attacker can craft a URL like:

https://victim-site.com/?social_icon=<script>alert('XSS')</script>

When a victim visits this URL, the JavaScript in the plugin processes the social_icon parameter and writes it directly into the page, executing the injected script. The attack is DOM-based because the payload never reaches the server; it is entirely processed client-side.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable version likely contains JavaScript similar to:

// Vulnerable code (version <= 2.7)
var icon = getParameterByName('social_icon');
document.getElementById('social-icons-container').innerHTML = icon;

A patched version would sanitize the input before DOM insertion:

// Patched code (hypothetical)
var icon = getParameterByName('social_icon');
var sanitizedIcon = DOMPurify.sanitize(icon);
document.getElementById('social-icons-container').innerHTML = sanitizedIcon;

Without an official patch, users must implement client-side sanitization or disable the plugin.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with BeBetter Social Icons <= 2.7 installed.
• A victim user with a modern browser.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., social_icon or icon).
2. Craft a malicious URL:

   https://victim-site.com/?social_icon=<img src=x onerror=alert(1)>
   

3. Deliver the URL via phishing email, social media, or embedded link.
4. When the victim clicks, the script executes in their browser context.

Proof-of-Concept (PoC) HTML page:

<!DOCTYPE html>
<html>
<head><title>PoC for CVE-2024-51880</title></head>
<body>
<h1>Click the link to trigger XSS</h1>
<a href="https://victim-site.com/?social_icon=<script>alert('XSS')</script>">Click me</a>
</body>
</html>

Blue Team

Detection Steps:

• Monitor web server logs for unusual query parameters containing <script>, <img onerror>, or other HTML/JavaScript tags.
• Use browser-based XSS filters (e.g., X-XSS-Protection header).
• Implement Content Security Policy (CSP) headers to block inline scripts.

Lab Setup for Testing:

1. Install a local WordPress instance with the vulnerable plugin.
2. Use a browser with developer tools to inspect DOM changes.
3. Simulate attack by appending malicious parameters to the URL.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing ?social_icon= or ?icon= followed by HTML/JavaScript payloads.
  • HTTP requests with Referer header pointing to crafted URLs.
• Host IOCs:
  • Presence of unexpected <script> tags in the DOM of pages using the plugin.
  • Browser console errors related to DOM manipulation.
• File IOCs:
  • Plugin file bebetter-social-icons/js/script.js (or similar) containing unsanitized innerHTML assignments.

Detection Engineering

YARA Rule

rule CVE_2024_51880_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS in BeBetter Social Icons plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51880"
    strings:
        $vuln_func = /\.innerHTML\s*=\s*[^;]*getParameterByName/i
        $param = /social_icon|icon/i
    condition:
        $vuln_func and $param
}

Sigma Rule

title: CVE-2024-51880 DOM-Based XSS in BeBetter Social Icons
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with malicious query parameters targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '?social_icon='
            - '?icon='
        c-uri|re: '(<script|<img onerror|alert\(|onload=)'
    condition: selection
falsepositives:
    - Legitimate use of social icon names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51880 DOM-Based XSS in BeBetter Social Icons"; flow:to_server,established; content:"?social_icon="; http_uri; pcre:"/(<script|<img onerror|alert\(|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Implement a Web Application Firewall (WAF) rule to block malicious query parameters.
3. Add Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-term Fix:

• Monitor the plugin's repository for updates. If no patch is provided, consider replacing the plugin with an alternative.
• Conduct a code review of the plugin's JavaScript to identify and sanitize all DOM manipulation points.

Workaround:

• Use a browser extension that blocks XSS (e.g., NoScript) for high-risk users.

Valters IT
Securing Digital Frontiers