CVE-2024-8741

Executive Summary

CVE-2024-8741 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Beam me up Scotty – Back to Top Button WordPress plugin, affecting all versions up to and including 1.0.21. The vulnerability arises from the insecure use of add_query_arg without proper escaping on a URL parameter, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction (e.g., clicking a crafted link), leading to script execution in the context of the victim’s browser session. This is a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise is indicated, but the unpatched status poses a risk to any site using the plugin. Users should monitor for updates or consider removing the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction, but the low complexity and no privileges requirement make it a viable phishing vector.

Deep Dive & Mechanics

The vulnerability is in the plugin’s handling of URL parameters via add_query_arg. The function constructs a URL without escaping the input, allowing an attacker to inject malicious JavaScript. When a victim clicks a crafted link, the injected script executes in the context of the WordPress admin or frontend, depending on the vulnerable endpoint.

Root Cause: The plugin uses add_query_arg to build a redirect or action URL but fails to escape the parameter value before output. This is a classic reflected XSS pattern.

Attack Flow:

1. Attacker crafts a malicious URL: https://target.com/wp-admin/admin.php?page=beam-me-up-scotty&_wp_http_referer=<script>alert('XSS')</script>
2. Victim clicks the link (e.g., via phishing email).
3. The plugin processes the _wp_http_referer parameter without escaping.
4. The injected script executes in the victim’s browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.21):

$url = add_query_arg( 'page', 'beam-me-up-scotty', admin_url( 'admin.php' ) );
$url = add_query_arg( '_wp_http_referer', $_GET['_wp_http_referer'], $url );
echo '<a href="' . $url . '">Back to Top</a>';

Patched Code (Hypothetical):

$url = add_query_arg( 'page', 'beam-me-up-scotty', admin_url( 'admin.php' ) );
$url = add_query_arg( '_wp_http_referer', esc_url( $_GET['_wp_http_referer'] ), $url );
echo '<a href="' . esc_url( $url ) . '">Back to Top</a>';

The patch uses esc_url() to sanitize the parameter before inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with plugin version <= 1.0.21.
• Victim must be logged in or have access to the admin area.

Exploit URL:

https://target.com/wp-admin/admin.php?page=beam-me-up-scotty&_wp_http_referer=javascript:alert(document.cookie)

Proof of Concept (Python):

import requests

target = "https://target.com"
payload = "javascript:alert('XSS')"
url = f"{target}/wp-admin/admin.php?page=beam-me-up-scotty&_wp_http_referer={payload}"

# Send to victim (simulated)
print(f"Send this link to victim: {url}")

Note: No public exploit code is available from Exploit-DB.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web logs for requests to /wp-admin/admin.php with page=beam-me-up-scotty and suspicious _wp_http_referer parameters.
2. Look for encoded JavaScript or unusual characters in the referer parameter.
3. Use WAF rules to block common XSS payloads in query strings.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri_path="/wp-admin/admin.php" uri_query="*page=beam-me-up-scotty*" uri_query="*_wp_http_referer=*" | regex uri_query="(_wp_http_referer=.*<script|<|>|alert|onerror|onload)"

Indicators of Compromise (IOCs)

• URL Pattern: /wp-admin/admin.php?page=beam-me-up-scotty&_wp_http_referer=<script>...
• Referer Header: Contains _wp_http_referer with XSS payloads.
• User-Agent: No specific pattern; attackers may use generic agents.
• File Hashes: N/A (no file uploads involved).

Detection Engineering

YARA Rule

rule CVE_2024_8741_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Beam me up Scotty plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8741"
    strings:
        $xss_payload = /_wp_http_referer=.*(<script|alert|onerror|onload|javascript:)/
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS via Beam me up Scotty Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts targeting CVE-2024-8741
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=beam-me-up-scotty'
        cs-uri-query|contains: '_wp_http_referer='
        cs-uri-query|re: '(_wp_http_referer=.*<script|<|>|alert|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with benign referer
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-8741 Reflected XSS in Beam me up Scotty Plugin";
    flow:to_server,established;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page=beam-me-up-scotty"; http_uri;
    content:"_wp_http_referer="; http_uri;
    pcre:"/_wp_http_referer=.*(<script|alert|onerror|onload|javascript:)/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement WAF rules to block XSS payloads in _wp_http_referer parameter.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Replace plugin with an alternative that is actively maintained.

Workaround:

• Add custom code to escape the _wp_http_referer parameter:

add_filter( 'query_vars', function( $vars ) {
    if ( isset( $_GET['_wp_http_referer'] ) ) {
        $_GET['_wp_http_referer'] = esc_url( $_GET['_wp_http_referer'] );
    }
    return $vars;
});

Valters IT
Securing Digital Frontiers