CVE-2024-13345

Executive Summary

CVE-2024-13345 is a critical vulnerability in the Avada Builder plugin for WordPress, affecting all versions up to and including 3.11.13. The flaw allows an unauthenticated attacker to execute arbitrary shortcodes due to insufficient validation before the do_shortcode function is called. This can lead to unauthorized data access, content manipulation, or further compromise of the WordPress site. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and commercial channels. Users should verify the integrity of their plugin files and ensure they are sourced from trusted vendors. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The high score reflects the ease of exploitation and the potential for arbitrary shortcode execution, which can be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The vulnerability resides in the Avada Builder plugin's handling of shortcode execution. The plugin exposes an action that allows users to trigger do_shortcode without proper validation of the input. Specifically, the code does not sanitize or validate the shortcode string before passing it to do_shortcode(), enabling an attacker to inject arbitrary shortcodes.

WordPress shortcodes can perform a wide range of actions, including:

• Executing PHP functions via [php] or similar shortcodes (if enabled).
• Accessing and modifying database content.
• Including arbitrary files.
• Executing system commands if combined with other vulnerabilities.

The attack vector is unauthenticated, meaning no login is required. The attacker only needs to send a crafted HTTP request to the vulnerable endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.11.13):

// In vulnerable version, the action handler directly calls do_shortcode without validation
add_action('wp_ajax_nopriv_avada_shortcode', 'avada_shortcode_handler');
function avada_shortcode_handler() {
    $shortcode = $_POST['shortcode'];
    echo do_shortcode($shortcode);
    wp_die();
}

Patched Code (Hypothetical):

// Patched version validates and sanitizes the shortcode
add_action('wp_ajax_nopriv_avada_shortcode', 'avada_shortcode_handler');
function avada_shortcode_handler() {
    $shortcode = sanitize_text_field($_POST['shortcode']);
    if (in_array($shortcode, allowed_shortcodes())) {
        echo do_shortcode($shortcode);
    } else {
        wp_die('Invalid shortcode');
    }
    wp_die();
}

The patch would restrict execution to a whitelist of allowed shortcodes and sanitize input.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install WordPress with Avada Builder plugin version 3.11.13.
2. Ensure the site is accessible over the network.

Exploitation Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin-ajax.php.
2. Send a POST request with the action parameter and malicious shortcode:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=avada_shortcode&shortcode=[php]echo 'PWNED';[/php]"

3. If the [php] shortcode is enabled, the server will execute the PHP code.

Alternative Payloads:

• [file]wp-config.php[/file] to read sensitive files.
• [db_query]SELECT * FROM wp_users[/db_query] to extract data.

Blue Team (Defense)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with the action=avada_shortcode parameter.
• Look for shortcode patterns in request bodies, especially those containing [php], [file], or [db_query].

Mitigation:

• Disable the vulnerable plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests containing avada_shortcode action.
• Restrict access to admin-ajax.php using IP whitelisting or authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=avada_shortcode.
  • Request bodies containing shortcode= followed by suspicious shortcode tags.
• File IOCs:
  • Unexpected files in the WordPress uploads directory.
  • Modified wp-config.php or other core files.
• Log IOCs:
  • Error logs showing do_shortcode calls with unexpected parameters.
  • Access logs with repeated admin-ajax.php requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2024_13345_Avada_Shortcode {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13345 in Avada Builder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13345"
    strings:
        $action = "avada_shortcode"
        $shortcode_param = "shortcode="
        $php_shortcode = "[php]"
        $file_shortcode = "[file]"
        $db_query_shortcode = "[db_query]"
    condition:
        $action and $shortcode_param and ($php_shortcode or $file_shortcode or $db_query_shortcode)
}

Sigma Rule

title: CVE-2024-13345 Avada Builder Shortcode Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-13345
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=avada_shortcode'
        cs-uri-query|contains: 'shortcode='
    condition: selection
falsepositives:
    - Legitimate use of Avada Builder shortcodes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13345 Avada Builder Shortcode Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=avada_shortcode"; http_client_body; content:"shortcode="; http_client_body; pcre:"/(\[php\]|\[file\]|\[db_query\])/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Avada Builder plugin until a patch is released.
2. Implement a WAF rule to block requests containing avada_shortcode action.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from the vendor when available.
• Update to a patched version of the plugin.
• Review and restrict shortcode capabilities in WordPress.

Workarounds:

• Use a security plugin to disable shortcode execution for unauthenticated users.
• Modify the .htaccess file to restrict access to admin-ajax.php:

<Files "admin-ajax.php">
    Require ip 192.168.1.0/24
</Files>

Valters IT
Securing Digital Frontiers