CVE-2024-2084

Executive Summary

CVE-2024-2084 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the HT Mega – Absolute Addons For Elementor WordPress plugin, affecting versions up to and including 2.4.6. The flaw resides in the plugin's lightbox widget, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with at least Contributor-level permissions to inject arbitrary web scripts. When a victim accesses a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects the WordPress ecosystem via the HT Mega plugin. Since WordPress plugins are distributed through the official WordPress Plugin Directory and third-party marketplaces, any site using this plugin is at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but its update mechanism relies on the WordPress admin dashboard. Administrators should verify the plugin version and apply any available updates immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for exploitation. An attacker with Contributor access can inject persistent XSS that affects all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the lightbox widget of the HT Mega plugin. The widget allows users to configure attributes such as image URLs, captions, and custom CSS classes. The plugin fails to properly sanitize and escape these attributes before rendering them in the HTML output. Specifically, the data-lightbox attribute or similar data attributes are not filtered, allowing an attacker to inject JavaScript event handlers like onmouseover or onclick.

When a Contributor-level user creates or edits a page using the lightbox widget, they can insert a payload such as:

<img src="x" onerror="alert('XSS')" />

or

<a href="#" onclick="alert(document.cookie)">Click me</a>

Because the plugin does not escape the attribute values, the injected script is stored in the WordPress database and executed when any user (including administrators) views the page.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.4.6): The lightbox widget likely outputs user-supplied attributes directly without escaping. For example:

echo '<div class="ht-lightbox" data-lightbox="' . $attributes['lightbox_data'] . '">';

Here, $attributes['lightbox_data'] is not sanitized or escaped.

Patched Code (hypothetical): A patch would use WordPress's built-in escaping functions:

echo '<div class="ht-lightbox" data-lightbox="' . esc_attr($attributes['lightbox_data']) . '">';

Additionally, input validation should strip any JavaScript event handlers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with HT Mega plugin version <= 2.4.6
• Contributor-level account or higher

Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one.
3. Add the HT Mega lightbox widget to the page.
4. In the widget settings, inject a malicious payload into a text field (e.g., "Custom CSS Class" or "Lightbox Data"). Example:

   " onmouseover="alert(document.cookie)
   

5. Save and publish the page.
6. When an administrator or visitor views the page, the script executes.

Proof-of-Concept Payload:

<img src=x onerror=alert('XSS')>

Blue Team

Detection:

• Monitor for pages created or edited by Contributor-level users containing suspicious HTML attributes.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to wp-admin/post.php.
• Review WordPress logs for unusual activity from Contributor accounts.

Mitigation:

• Disable the HT Mega plugin until a patch is available.
• Restrict Contributor permissions to prevent use of the lightbox widget.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ht-mega-for-elementor/ (version <= 2.4.6)
• Database entries: Pages or posts containing unescaped HTML attributes in the post_content field.
• Network traffic: HTTP requests to wp-admin/post.php with payloads containing onerror, onmouseover, or onclick.
• Logs: WordPress debug logs showing PHP notices related to the lightbox widget.

Detection Engineering

YARA Rule

rule CVE_2024_2084_HT_Mega_XSS {
    meta:
        description = "Detects stored XSS payloads in HT Mega plugin lightbox widget"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2084"
    strings:
        $payload1 = "onerror="
        $payload2 = "onmouseover="
        $payload3 = "onclick="
        $payload4 = "javascript:"
        $widget = "ht-lightbox"
    condition:
        $widget and any of ($payload*)
}

Sigma Rule

title: CVE-2024-2084 HT Mega Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via HT Mega lightbox widget
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: 
            - 'onerror='
            - 'onmouseover='
            - 'onclick='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2084 HT Mega Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"onerror="; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Update to the latest version (if a patch is released).
3. Restrict Contributor permissions to prevent use of the lightbox widget.
4. Implement a WAF to block XSS payloads.

Long-term:

• Monitor the plugin's official page for updates.
• Conduct regular security audits of WordPress plugins.
• Educate users with Contributor roles about safe content creation.

Valters IT
Securing Digital Frontiers