CVE-2024-13319

Executive Summary

CVE-2024-13319 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.6.5. The vulnerability arises from the insecure use of add_query_arg without proper escaping on URL parameters. An unauthenticated attacker can inject arbitrary web scripts that execute when a victim clicks a crafted link. This is a WordPress ecosystem issue, not related to Apache or Nginx. The CVSS score is 6.1 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently. No public proof-of-concept or patch details are available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the need for user interaction, but the impact is limited to low confidentiality and integrity compromise.

Deep Dive & Mechanics

The vulnerability is located in the Themify Builder plugin's handling of URL parameters. The add_query_arg function is used to construct URLs without proper escaping, allowing an attacker to inject malicious JavaScript code via a crafted query string. When a victim clicks a specially crafted link, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites.

The vulnerable code likely appears in a function that builds URLs for admin or frontend pages. The lack of escaping on user-supplied input allows the injection of arbitrary HTML and JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.6.5):

$url = add_query_arg( 'param', $_GET['param'], admin_url( 'admin.php' ) );
echo '<a href="' . $url . '">Link</a>';

Patched Code (hypothetical):

$url = add_query_arg( 'param', esc_url_raw( $_GET['param'] ), admin_url( 'admin.php' ) );
echo '<a href="' . esc_url( $url ) . '">Link</a>';

The patched version uses esc_url_raw and esc_url to sanitize the URL and its parameters, preventing script injection.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with Themify Builder plugin version 7.6.5.
2. Craft Payload: Create a URL with a malicious parameter:

   http://target.com/wp-admin/admin.php?page=themify-builder&param=<script>alert('XSS')</script>
   

3. Deliver: Send the link to a victim via email or social engineering.
4. Execute: When the victim clicks the link, the script executes in their browser.

Blue Team

1. Detection: Monitor for unusual query strings containing <script> tags or event handlers.
2. Prevention: Implement Web Application Firewall (WAF) rules to block XSS patterns.
3. Response: If exploitation is detected, isolate the affected user session and review logs for malicious activity.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing ?page=themify-builder&param= followed by <script> or onerror= etc.
• Log Entries: HTTP requests with suspicious query strings to /wp-admin/admin.php.
• Network Traffic: Outbound connections to known malicious domains from compromised WordPress instances.

Detection Engineering

YARA Rule

rule CVE_2024_13319_XSS {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13319"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $xss1 = /param=.*<script/i
        $xss2 = /param=.*onerror=/i
        $xss3 = /param=.*onload=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13319 Reflected XSS in Themify Builder
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts via add_query_arg in Themify Builder
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/admin.php"
        c-uri|contains: "page=themify-builder"
        c-uri|contains|re: "(<script|onerror=|onload=)"
    condition: selection
falsepositives:
    - Legitimate use of script tags in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13319 Reflected XSS in Themify Builder"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=themify-builder"; http_uri; pcre:"/(<script|onerror=|onload=)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Themify Builder plugin until a patch is available.
2. Short-term: Implement a WAF rule to block XSS patterns in query strings.
3. Long-term: Update to a patched version once released by the vendor.
4. Compensating Controls: Use Content Security Policy (CSP) headers to mitigate XSS impact.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert