CVE-2024-4489

Executive Summary

CVE-2024-4489 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Royal Elementor Addons and Templates plugin for WordPress, affecting versions up to and including 1.3.976. The flaw resides in the custom_upload_mimes function, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page, leading to potential session hijacking, data theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.4) and currently has no known public exploit or patch.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Royal Elementor Addons plugin extends the Elementor page builder, and the flaw is introduced through a custom file upload MIME type handling function. Attackers leverage the plugin’s file upload capabilities to inject malicious scripts, which are then stored and executed in the context of the victim’s browser.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level or higher authentication.
• User Interaction (UI): None (N) – No user action needed for execution.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 6.4, the requirement for authenticated access reduces the immediate risk. However, the potential for widespread exploitation in multi-author WordPress sites is significant.

Deep Dive & Mechanics

The vulnerability is rooted in the custom_upload_mimes function, which is intended to allow administrators to define custom MIME types for file uploads. The function fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the WordPress admin interface. Specifically, when a contributor or higher-privileged user uploads a file with a crafted MIME type string containing JavaScript, the plugin stores this string without escaping. When an administrator or other user views the media library or file upload settings page, the injected script executes in their browser.

Attack Flow:

1. An authenticated attacker with contributor-level access navigates to the media upload page.
2. The attacker uploads a file (e.g., an SVG or HTML file) with a MIME type containing a malicious payload, such as text/html"><script>alert('XSS')</script>.
3. The plugin’s custom_upload_mimes function stores this MIME type in the database without proper sanitization.
4. When an administrator or other user accesses the media library or file upload settings, the stored MIME type is rendered without escaping, executing the script.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.3.976):

function custom_upload_mimes( $mimes ) {
    $custom_mimes = get_option( 'wpr_custom_mimes', array() );
    foreach ( $custom_mimes as $mime ) {
        $mimes[$mime['ext']] = $mime['type']; // No sanitization
    }
    return $mimes;
}

Patched Code (hypothetical fix):

function custom_upload_mimes( $mimes ) {
    $custom_mimes = get_option( 'wpr_custom_mimes', array() );
    foreach ( $custom_mimes as $mime ) {
        $mimes[sanitize_key( $mime['ext'] )] = esc_attr( $mime['type'] ); // Sanitize and escape
    }
    return $mimes;
}

The patched version uses sanitize_key() for the extension and esc_attr() for the MIME type to prevent script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Royal Elementor Addons <= 1.3.976.
• Contributor-level or higher account.

Steps:

1. Log in as a contributor.
2. Navigate to Media > Add New.
3. Upload a file (e.g., malicious.svg) with a crafted MIME type using a tool like Burp Suite or cURL:

   curl -X POST -F "file=@malicious.svg" -F "mime_type=text/html\"><script>alert('XSS')</script>" http://target.com/wp-admin/upload.php
   

4. The script is stored and will execute when an admin views the media library.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual MIME types in file uploads (e.g., text/html for SVG files).
• Look for custom_upload_mimes function calls with unsanitized input.
• Use WAF rules to block suspicious MIME type strings.

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor-level uploads to safe file types.
• Implement Content Security Policy (CSP) headers to mitigate XSS.

Indicators of Compromise (IOCs)

• File: Uploaded files with MIME types containing JavaScript (e.g., text/html"><script>alert(1)</script>).
• Database: Entries in wp_options with option_name = 'wpr_custom_mimes' containing malicious MIME strings.
• Logs: HTTP requests to /wp-admin/upload.php with unusual mime_type parameters.
• Network: Outbound connections from compromised admin sessions to attacker-controlled servers.

Detection Engineering

YARA Rule

rule CVE_2024_4489_Stored_XSS {
    meta:
        description = "Detects malicious MIME type strings in WordPress uploads"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-4489"
    strings:
        $mime_payload = /text\/html[\s\S]*<script[\s\S]*<\/script>/i
    condition:
        $mime_payload
}

Sigma Rule

title: CVE-2024-4489 Stored XSS via Custom MIME Types
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit Stored XSS in Royal Elementor Addons
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/upload.php'
        cs-uri-query|contains: 'mime_type'
    condition: selection
falsepositives:
    - Legitimate custom MIME type configurations
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4489 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/upload.php"; http_uri; content:"mime_type"; http_client_body; pcre:"/text\/html[\s\S]*<script[\s\S]*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict contributor-level uploads to only safe file types (e.g., images, PDFs).
3. Implement a Web Application Firewall (WAF) rule to block suspicious MIME type strings.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• Upgrade to a patched version once available.
• Conduct a security audit of all custom MIME type handling functions.

Workarounds:

• Use a security plugin like Wordfence to add input sanitization.
• Manually patch the custom_upload_mimes function as shown in the patched code section.

Valters IT