CVE-2024-2733

Executive Summary

CVE-2024-2733 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 4.8.8. The flaw resides in the plugin's "Separator" element, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known public exploit or patch.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Bold Page Builder plugin is a commercial page builder, and the flaw is in its "Separator" element. Attackers must have contributor-level access or higher, meaning the attack surface is limited to authenticated users. However, given the widespread use of page builders, the impact can be significant if a contributor account is compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs contributor-level access.
• User Interaction (UI): None – no user action needed for exploitation.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a widely-used page builder plugin makes it a credible threat, especially in multi-author WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the "Separator" element of the Bold Page Builder plugin. The plugin fails to properly sanitize user-supplied attributes (e.g., class, style, or custom data attributes) when rendering the separator HTML. An attacker with contributor-level access can craft a malicious separator element containing JavaScript payloads in these attributes.

Root Cause: Insufficient input sanitization and output escaping. The plugin likely uses echo or print without applying WordPress's built-in escaping functions like esc_attr() or wp_kses().

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates or edits a page/post using the Bold Page Builder.
3. Adds a "Separator" element and injects a malicious payload into an attribute (e.g., onmouseover or style with background-image: url(javascript:...)).
4. Saves/publishes the page.
5. When any user (including admins) visits the page, the script executes.

Example Payload (conceptual):

[bold_separator class="test" style="background-image: url('javascript:alert(document.cookie)')"]

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the plugin's rendering function for the separator element. A patched version would use proper escaping.

Vulnerable Code (Conceptual):

echo '<div class="' . $attributes['class'] . '" style="' . $attributes['style'] . '"></div>';

Patched Code (Conceptual):

echo '<div class="' . esc_attr($attributes['class']) . '" style="' . esc_attr($attributes['style']) . '"></div>';

The patched version uses esc_attr() to escape attribute values, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Bold Page Builder <= 4.8.8.
• Contributor-level account credentials.

Steps:

1. Log in to WordPress as a contributor.
2. Create a new page or edit an existing one.
3. Switch to the Bold Page Builder editor.
4. Add a "Separator" element.
5. In the element's settings, inject a payload into an attribute. For example, in the "Custom CSS Class" field, enter:

   " onmouseover="alert(document.cookie)
   

6. Save and publish the page.
7. When any user visits the page, the script executes.

Proof-of-Concept (PoC) Code:

<!-- This is a conceptual payload; actual exploitation may vary -->
<div class="bold-separator" onmouseover="alert('XSS')">Separator</div>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual attribute values in page builder elements.
• Look for on* event handlers or javascript: URIs in page content.
• Use WAF rules to block common XSS patterns.

Defense:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a Web Application Firewall (WAF) with XSS detection rules.
• Regularly audit user roles and permissions.

Indicators of Compromise (IOCs)

• File System: Modified page/post content in the WordPress database containing malicious JavaScript.
• Network: HTTP requests to pages with injected scripts; possible callback to attacker-controlled servers.
• Logs: WordPress audit logs showing page edits by contributor-level users with unusual attribute values.
• Browser: Execution of unexpected JavaScript (e.g., alert() or document.cookie access).

Example IOC in Database:

SELECT * FROM wp_posts WHERE post_content LIKE '%onmouseover%' OR post_content LIKE '%javascript:%';

Detection Engineering

YARA Rule

rule CVE_2024_2733_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder separator elements"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-2733"
    strings:
        $xss1 = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $xss2 = /javascript\s*:/ nocase
        $xss3 = /<[^>]*\s+style\s*=\s*["'][^"']*url\s*\(/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2733 - Bold Page Builder Stored XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in Bold Page Builder separator elements
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - 'onmouseover'
            - 'onclick'
            - 'javascript:'
            - 'style='
    condition: selection
falsepositives:
    - Legitimate use of style attributes
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2733 - Bold Page Builder Stored XSS"; flow:to_server,established; content:"onmouseover"; nocase; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with XSS rules.
4. Add Content Security Policy (CSP) headers to mitigate script execution.

Long-Term Fix:

• The vendor must release a patched version that properly escapes user-supplied attributes.
• As a workaround, developers can modify the plugin code to use esc_attr() and wp_kses().

Detection:

• Monitor WordPress audit logs for unusual page edits.
• Scan database for XSS patterns using the provided YARA rule.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert