CVE-2024-2539

Executive Summary

CVE-2024-2539 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.6. The flaw resides in insufficient input sanitization and output escaping on user-supplied _id attributes within widget shortcodes. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. With a CVSS score of 6.4 (Medium), this vulnerability poses a significant risk to WordPress sites using the plugin, enabling session hijacking, defacement, or redirection to malicious sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly through the WordPress admin dashboard or via manual upload, making the supply chain risk limited to the plugin’s update mechanism and the integrity of the WordPress repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access.
• User Interaction (UI): None (N) – No user action needed for execution.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a widely-used plugin makes it a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the _id attribute of various widgets provided by the Elementor Addons by Livemesh plugin. When a user with contributor-level privileges creates or edits a page using the Elementor builder, they can supply a malicious payload in the _id field of a widget. The plugin fails to properly sanitize this input and escape it when rendering the page, allowing the injection of arbitrary JavaScript.

The attack flow:

1. An authenticated contributor creates a new page or edits an existing one.
2. In the Elementor editor, they add a Livemesh widget (e.g., a heading, portfolio, or testimonial).
3. They modify the widget’s _id attribute to include a JavaScript payload, such as "><script>alert('XSS')</script>.
4. The plugin stores the payload in the database without proper sanitization.
5. When any user (including administrators) visits the page, the payload executes in their browser.

The root cause is the lack of input validation and output escaping on the _id attribute, which is directly echoed into the HTML without being filtered.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 8.3.6):

// In a widget's render method
$id = $settings['_id'];
echo '<div id="' . $id . '">'; // No sanitization or escaping

Patched Code (hypothetical fix):

// Properly escape the attribute
$id = esc_attr($settings['_id']);
echo '<div id="' . $id . '">';

The fix involves using WordPress’s esc_attr() function to escape the _id value before output, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Elementor Addons by Livemesh version <= 8.3.6.
• An account with contributor-level privileges or higher.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Open the Elementor editor.
4. Add a Livemesh widget (e.g., "Heading").
5. In the widget settings, locate the _id field (may be hidden; use browser developer tools to find it).
6. Inject a payload: "><img src=x onerror=alert('XSS')>
7. Save and publish the page.
8. When any user visits the page, the script executes.

Proof-of-Concept (PoC) Code:

// No public exploit code available; this is a conceptual PoC.
// The payload is injected via the Elementor editor's widget settings.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual _id attribute values in page content.
• Look for JavaScript event handlers (e.g., onerror, onload) in widget attributes.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php.

Response:

1. Immediately disable the plugin if no patch is available.
2. Scan the database for malicious payloads using a security plugin (e.g., Wordfence).
3. Remove any injected scripts from pages.
4. Reset credentials for affected users.

Indicators of Compromise (IOCs)

• File Hashes: N/A (no malicious files).
• Network Indicators: Requests to /wp-admin/admin-ajax.php with suspicious _id parameters.
• Database Indicators: Rows in wp_postmeta containing JavaScript payloads in _id meta keys.
• Log Entries: WordPress debug logs showing unescaped output in widget rendering.

Detection Engineering

YARA Rule

rule CVE_2024_2539_XSS {
    meta:
        description = "Detects stored XSS payloads in Livemesh Elementor Addons _id attribute"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2539"
    strings:
        $xss1 = /_id["']?\s*[:=]\s*["'][^"']*<script/i
        $xss2 = /_id["']?\s*[:=]\s*["'][^"']*onerror/i
        $xss3 = /_id["']?\s*[:=]\s*["'][^"']*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2539 Stored XSS in Livemesh Elementor Addons
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in the _id attribute of Livemesh widgets
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body|contains: '_id'
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2539 Stored XSS in Livemesh Elementor Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"_id"; http_client_body; pcre:"/_id["']?\s*[:=]\s*["'][^"']*(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Use a Web Application Firewall (WAF) to block XSS payloads in _id attributes.
3. Restrict contributor-level access to trusted users only.

Long-Term Fix:

• Apply the official patch from Livemesh when available (currently UNKNOWN).
• Implement input validation and output escaping for all user-supplied attributes in custom code.

Workaround:

• Manually edit the plugin files to add esc_attr() around $settings['_id'] in all widget render methods.

Valters IT
Securing Digital Frontiers