CVE-2024-3337

Executive Summary

CVE-2024-3337 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.272. The flaw resides in the colibri_breadcrumb_element shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the Colibri Page Builder plugin distributed via the WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. Users should monitor the plugin’s official page for updates and consider removing the plugin if no patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent script injection affecting all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the colibri_breadcrumb_element shortcode handler. The plugin fails to sanitize and escape user-supplied attributes (e.g., class, id, or custom data attributes) before rendering them in the HTML output. An attacker with contributor-level access can create or edit a post/page and insert the shortcode with malicious payloads:

[colibri_breadcrumb_element class="test\" onmouseover=\"alert(1)\""]

When the page is rendered, the unsanitized attribute is injected directly into the HTML, causing the browser to execute the attacker’s JavaScript. Since the script is stored in the database, it executes for every visitor.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function colibri_breadcrumb_shortcode($atts) {
    $class = $atts['class'];
    return "<div class='$class'>Breadcrumb</div>";
}

Patched Code (expected):

function colibri_breadcrumb_shortcode($atts) {
    $class = esc_attr($atts['class']);
    return "<div class='$class'>Breadcrumb</div>";
}

The patched version uses esc_attr() to escape attribute values, preventing XSS.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with Colibri Page Builder <= 1.0.272, contributor-level account.
2. Steps:
   • Log in as contributor.
   • Create a new post.
   • Insert the shortcode with a malicious attribute:

     [colibri_breadcrumb_element class="x\" onfocus=\"alert(document.cookie)\" autofocus=\"true"]
     

   • Publish the post.
   • When any user visits the post, the XSS triggers.

Blue Team

1. Detection: Monitor for posts containing colibri_breadcrumb_element shortcode with suspicious attributes.
2. Mitigation: Disable the plugin or apply a WAF rule to block shortcode attributes containing event handlers.
3. Forensics: Check database for injected scripts in wp_posts.post_content.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/colibri-page-builder/ (entire plugin directory)
• Database: Posts/pages containing [colibri_breadcrumb_element with unescaped attributes
• Network: HTTP requests to pages with the vulnerable shortcode
• Logs: WordPress audit logs showing shortcode usage by contributors

Detection Engineering

YARA Rule

rule colibri_xss_cve_2024_3337 {
    meta:
        description = "Detects Colibri Page Builder XSS payloads in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3337"
    strings:
        $shortcode = /\[colibri_breadcrumb_element[^\]]*?on\w+\s*=\s*["'][^"']*?["']/i
    condition:
        $shortcode
}

Sigma Rule

title: Colibri Page Builder XSS via Shortcode
id: cve-2024-3337
status: experimental
description: Detects stored XSS attempts via colibri_breadcrumb_element shortcode
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "colibri_breadcrumb_element"
        http.url|re: "on\w+="
    condition: selection
falsepositives:
    - Legitimate use of shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3337 Colibri XSS Attempt"; flow:to_server,established; content:"colibri_breadcrumb_element"; http_uri; pcre:"/on\w+=\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Colibri Page Builder plugin until a patch is available.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block shortcode attributes containing event handlers (e.g., onmouseover, onfocus).
3. Long-term: Apply the vendor patch when released, or remove the plugin permanently.
4. Workaround: Restrict contributor-level users from using shortcodes via user role editor plugins.

Valters IT
Securing Digital Frontiers