CVE-2024-37297: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in WooCommerce versions 8.8.0 and later, affecting the e-commerce platform built on WordPress. The vulnerability was introduced in WooCommerce 8.8 and allows attackers to manipulate links to include malicious HTML and JavaScript content. The issue was patched in versions 8.8.5 and 8.9.3, with the fix also included in WooCommerce 9.0 (WooCommerce Advisory, GitHub Advisory).

The vulnerability stems from the Order Attribution feature introduced in WooCommerce 8.5, which uses the Sourcebuster.js library to read traffic source data. In version 8.8, changes to the client-side implementation created a vulnerability where URL content read through the Sourcebuster.js library was inserted without proper sanitization into the classic checkout and registration forms. The issue has been assigned a CVSS v3.1 score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

While the malicious content is not saved to the database, the vulnerability allows attackers to create links that, when clicked by victims, could execute arbitrary JavaScript code in their browsers. This could lead to the hijacking of content and data stored in the browser, including the user's session (WooCommerce Advisory).

The vulnerability can be exploited by manipulating links to include malicious content that targets the registration and classic checkout forms. Proof of concept examples include manipulated URLs targeting the my-account and classic-checkout pages. The vulnerability is only exploitable when the Order Attribution feature is enabled, which is the default setting in affected versions (WPScan).

Users are advised to immediately update to either WooCommerce 8.9.3 or the backported version 8.8.5. For those unable to update immediately, a temporary workaround is available by disabling the Order Attribution feature. However, regular updates are strongly recommended for long-term security (WooCommerce Advisory).

The vulnerability was responsibly disclosed through WooCommerce's HackerOne Bug Bounty program by security researcher Eric Caron. Some users reported experiencing a large number of false registrations and order placement attempts around the time the vulnerability was discovered (WooCommerce Advisory).