CVE-2024-8665

Executive Summary

CVE-2024-8665 is a reflected Cross-Site Scripting (XSS) vulnerability in the YITH Custom Login plugin for WordPress, affecting all versions up to and including 1.7.3. The flaw arises from the insecure use of add_query_arg() without proper output escaping on URL parameters. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, executes arbitrary JavaScript in the context of the WordPress admin panel. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as WordPress ecosystem issue and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are affected. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant compromise of WordPress admin sessions.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of URL parameters when constructing redirect URLs or admin links. The add_query_arg() function is used to append query parameters to a URL, but the output is not escaped before being rendered in the HTML. An attacker can inject a malicious JavaScript payload via a crafted URL parameter (e.g., ?redirect_to=javascript:alert(1) or ?page=...&<script>alert(1)</script>). When the plugin generates a link or redirect URL containing this parameter, the script executes in the victim's browser.

Root Cause: The plugin uses add_query_arg() and then directly echoes or prints the result without passing it through esc_url() or esc_attr(). This allows unescaped special characters to break out of the HTML context.

Attack Vector: The attacker sends a phishing email or posts a crafted link on a forum. The link points to a WordPress admin page that uses the vulnerable plugin. When an admin clicks the link, the injected script runs, potentially stealing cookies or performing actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.7.3):

<?php
// Example vulnerable usage
$url = add_query_arg( 'some_param', $_GET['some_param'], admin_url( 'admin.php' ) );
echo '<a href="' . $url . '">Click here</a>';
?>

Patched Code (hypothetical fix):

<?php
// Patched version uses esc_url()
$url = add_query_arg( 'some_param', $_GET['some_param'], admin_url( 'admin.php' ) );
echo '<a href="' . esc_url( $url ) . '">Click here</a>';
?>

The patched version ensures that the entire URL is escaped, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with YITH Custom Login plugin version <= 1.7.3.
• A victim with admin privileges.

Exploit Steps:

1. Identify a vulnerable endpoint. For example, the plugin's settings page might accept a redirect_to parameter.
2. Craft a malicious URL:

   http://target.com/wp-admin/admin.php?page=yith_custom_login&redirect_to=javascript:alert(document.cookie)
   

3. Encode the payload if needed to bypass filters:

   http://target.com/wp-admin/admin.php?page=yith_custom_login&redirect_to=%6A%61%76%61%73%63%72%69%70%74%3A%61%6C%65%72%74%28%31%29
   

4. Send the link to the victim via email or social engineering.
5. When the victim clicks, the JavaScript executes in the admin context.

Proof-of-Concept (PoC) Code:

<!-- Simple PoC link -->
<a href="http://target.com/wp-admin/admin.php?page=yith_custom_login&redirect_to=javascript:alert('XSS')">Click me</a>

Blue Team (Defender)

Detection:

• Monitor web server logs for requests containing page=yith_custom_login and suspicious redirect_to parameters (e.g., containing javascript:, <script>, or base64-encoded payloads).
• Use WAF rules to block requests with redirect_to containing javascript: or HTML tags.

Hunting:

• Search for any admin users who clicked on suspicious links.
• Review plugin file integrity to ensure no backdoors were planted.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-admin/admin.php?page=yith_custom_login&redirect_to=*
  • Parameters containing javascript:, data:, or <script> tags.
• Log Entries:
  • HTTP requests with User-Agent not matching typical browsers.
  • Repeated requests to the same admin page with varying redirect_to values.
• File Changes:
  • Modified plugin files (e.g., yith-custom-login.php) containing unexpected JavaScript or PHP code.

Detection Engineering

YARA Rule

rule CVE_2024_8665_YITH_Custom_Login_XSS {
    meta:
        description = "Detects YITH Custom Login plugin files vulnerable to reflected XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8665"
    strings:
        $vuln_func = "add_query_arg" nocase
        $vuln_echo = /echo\s*.*add_query_arg/ nocase
    condition:
        $vuln_func and $vuln_echo
}

Sigma Rule

title: Reflected XSS via YITH Custom Login Plugin
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts targeting YITH Custom Login plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=yith_custom_login'
        cs-uri-query|contains|expand:
            - 'redirect_to=javascript:'
            - 'redirect_to=<script>'
            - 'redirect_to=%3Cscript%3E'
    condition: selection
falsepositives:
    - Legitimate use of redirect_to parameter with safe URLs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8665 YITH Custom Login Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=yith_custom_login"; http_uri; pcre:"/redirect_to=(javascript:|<script>|%3Cscript%3E)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update to the latest version immediately.
2. Disable the plugin: If no patch is available, deactivate and delete the YITH Custom Login plugin until a fix is released.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing redirect_to=javascript: or <script> in the query string.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of all WordPress plugins.
• Educate administrators about phishing attacks and the risks of clicking unknown links.

Valters IT
Securing Digital Frontiers