CVE-2024-1396

Executive Summary

CVE-2024-1396 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw exists in all versions up to and including 2.15.7. An authenticated attacker with at least contributor-level permissions can inject arbitrary web scripts via the title_tag parameter. The vulnerability stems from insufficient input sanitization and output escaping. When a user accesses a page containing the injected script, it executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and affects sites using the Phlox theme with the auxin-elements plugin. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access, but the potential for widespread impact on WordPress sites using the plugin elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the title_tag parameter of shortcodes provided by the auxin-elements plugin. The plugin fails to properly sanitize user input and escape output when rendering shortcodes. An attacker with contributor-level access can create or edit a post/page and insert a malicious shortcode with a crafted title_tag value containing JavaScript.

When the page is rendered, the injected script is stored in the database and executed in the browsers of all visitors. This is a classic stored XSS attack. The lack of output escaping means the script is treated as HTML/JavaScript rather than plain text.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.15.7):

// In shortcode handler
$title_tag = isset($atts['title_tag']) ? $atts['title_tag'] : 'h2';
echo '<' . $title_tag . ' class="aux-title">' . $content . '</' . $title_tag . '>';

Patched Code (hypothetical fix):

// In shortcode handler
$allowed_tags = array('h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span');
$title_tag = isset($atts['title_tag']) ? $atts['title_tag'] : 'h2';
if (!in_array($title_tag, $allowed_tags)) {
    $title_tag = 'h2';
}
echo '<' . esc_attr($title_tag) . ' class="aux-title">' . esc_html($content) . '</' . esc_attr($title_tag) . '>';

The patched version validates the title_tag against a whitelist and uses esc_attr() and esc_html() for output escaping.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress installation with auxin-elements plugin <= 2.15.7, contributor-level account.
2. Steps:
   • Log in as a contributor.
   • Create a new post or page.
   • Insert a shortcode like: [aux_shortcode title_tag="h2 onclick=alert(1)"]Test[/aux_shortcode]
   • Publish the post.
   • When any user visits the post, the JavaScript executes.

Example Payload:

[aux_shortcode title_tag="h2 onmouseover=alert(document.cookie)"]Hover me[/aux_shortcode]

Blue Team

1. Detection: Monitor for unusual shortcode usage in post content, especially title_tag values containing HTML event handlers or script tags.
2. Prevention: Implement a Web Application Firewall (WAF) rule to block requests with suspicious title_tag parameters.
3. Response: If compromised, remove the malicious post, update the plugin, and rotate user sessions.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/ (version <= 2.15.7)
• Database: Posts/pages containing shortcodes with title_tag values that include onerror, onclick, onmouseover, <script>, or javascript:.
• Network: HTTP requests to WordPress admin with title_tag parameter containing suspicious characters.
• Logs: WordPress debug logs showing unexpected shortcode attributes.

Detection Engineering

YARA Rule

rule CVE_2024_1396_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting auxin-elements title_tag parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1396"
    strings:
        $payload1 = /title_tag\s*=\s*["'][^"']*?(on\w+\s*=|javascript:|<script)/i
        $payload2 = /\[aux_shortcode[^\]]*title_tag\s*=\s*["'][^"']*?[<>]/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1396 Stored XSS in auxin-elements Plugin
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via title_tag parameter in auxin-elements shortcodes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'title_tag'
        cs-uri-query|re: '(on\w+=|javascript:|<script)'
    condition: selection
falsepositives:
    - Legitimate use of HTML attributes in shortcodes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1396 Stored XSS in auxin-elements title_tag"; flow:to_server,established; content:"title_tag"; http_uri; pcre:"/title_tag\s*=\s*["'][^"']*?(on\w+\s*=|javascript:|<script)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the auxin-elements plugin until a patch is available.
2. Short-term: Restrict contributor-level permissions to trusted users only.
3. Long-term: Apply input validation and output escaping to all shortcode parameters. Use a whitelist for allowed HTML tags.
4. Monitor: Review WordPress logs for suspicious shortcode usage.
5. Update: Watch for plugin updates from Auxin and apply immediately.

Valters IT
Securing Digital Frontiers