CVE-2024-47353

Executive Summary

CVE-2024-47353 is an Open Redirect vulnerability (CWE-601) in the Quomodosoft ElementsReady Addons for Elementor WordPress plugin (slug: element-ready-lite). This flaw allows an unauthenticated attacker to craft a malicious link that, when clicked by a logged-in administrator or editor, redirects the user to an arbitrary external domain. The vulnerability affects all versions up to and including 6.4.2. As of this report, no official patch has been released by the vendor, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the risk is elevated due to the plugin’s widespread use in WordPress ecosystems.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is limited to WordPress site administrators who install the plugin directly from the WordPress repository or via third-party sources. No known malicious commits or backdoors have been identified in the plugin’s source code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click the crafted link
• Scope: Changed (S:C) – redirect to an untrusted site
• Confidentiality Impact: Low (C:L) – potential leakage of referrer headers
• Integrity Impact: Low (I:L) – phishing or credential theft via fake login pages
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the open redirect can be weaponized for phishing campaigns, credential harvesting, or bypassing URL validation in security controls.

Deep Dive & Mechanics

The vulnerability exists in the element-ready-lite plugin’s URL handling logic. The plugin likely uses a wp_redirect() or wp_safe_redirect() function with user-supplied input (e.g., via a redirect_to parameter in a shortcode or AJAX endpoint) without proper validation. An attacker can craft a URL like:

https://victim-site.com/?element-ready-redirect=https://evil.com

When a user clicks this link, the plugin processes the redirect_to parameter and performs an HTTP redirect to the attacker-controlled domain. The lack of a whitelist or domain validation allows redirection to any external site.

Root Cause: The plugin does not sanitize or validate the redirect destination against an allowed list of domains. The wp_safe_redirect() function, if used, should have been employed with a whitelist, but the plugin likely uses wp_redirect() directly.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred. A typical vulnerable snippet might look like:

// Vulnerable code (element-ready-lite <= 6.4.2)
$redirect_url = $_GET['redirect_to'];
if (!empty($redirect_url)) {
    wp_redirect($redirect_url);
    exit;
}

A patched version would implement a whitelist:

// Patched code (hypothetical)
$allowed_domains = array('example.com', 'sub.example.com');
$redirect_url = $_GET['redirect_to'];
$parsed_url = parse_url($redirect_url);
if (!empty($redirect_url) && in_array($parsed_url['host'], $allowed_domains)) {
    wp_redirect($redirect_url);
    exit;
} else {
    // Redirect to a safe default
    wp_redirect(home_url());
    exit;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with element-ready-lite version <= 6.4.2 installed and activated.
• An attacker-controlled domain (e.g., evil.com).

Exploitation Steps:

1. Identify the vulnerable parameter. Common parameters include redirect_to, url, or return. Use a web proxy (Burp Suite) to intercept plugin requests.
2. Craft a malicious link:

   https://victim-site.com/?element-ready-redirect=https://evil.com/phishing.html
   

3. Send the link to a logged-in administrator via email or social engineering.
4. When the admin clicks the link, they are redirected to evil.com/phishing.html, which can mimic the WordPress login page to steal credentials.

No public exploit code is available for this CVE.

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for unusual redirect_to parameters pointing to external domains.
• Use WAF rules to block requests containing redirect_to with external URLs.

Lab Setup:

• Install a vulnerable WordPress instance with element-ready-lite 6.4.2.
• Use a local DNS resolver to simulate attacker domain.
• Test the redirect by accessing the crafted URL and observing the HTTP 302 response.

Indicators of Compromise (IOCs)

• URL Patterns: /?element-ready-redirect=* or /?redirect_to=* where the value is an external domain.
• HTTP Response: 302 redirect to an external domain.
• Referrer Headers: Referer: https://victim-site.com/?element-ready-redirect=https://evil.com
• Log Entries: Apache/Nginx access logs showing GET /?element-ready-redirect=https://evil.com with a 302 status.

Detection Engineering

YARA Rule

rule CVE_2024_47353_Open_Redirect {
    meta:
        description = "Detects open redirect attempts targeting Quomodosoft ElementsReady plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47353"
    strings:
        $redirect_param = "element-ready-redirect" nocase
        $redirect_to = "redirect_to" nocase
        $wp_redirect = "wp_redirect" nocase
    condition:
        any of ($redirect_param, $redirect_to) and $wp_redirect
}

Sigma Rule

title: CVE-2024-47353 Open Redirect via ElementsReady Plugin
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects HTTP requests with open redirect parameters targeting the ElementsReady plugin
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "element-ready-redirect="
            - "redirect_to="
    condition: selection
falsepositives:
    - Legitimate use of redirect parameters by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47353 Open Redirect - ElementsReady Plugin"; flow:to_server; content:"GET"; http_method; content:"element-ready-redirect="; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a WAF rule to block requests containing element-ready-redirect or redirect_to parameters with external URLs.
3. Educate users about phishing risks and to avoid clicking suspicious links.

Long-term Fix:

• Monitor the plugin’s official page for updates. If no patch is released within 30 days, consider replacing the plugin with an alternative.
• Apply a virtual patch using a security plugin (e.g., Wordfence) to block open redirect patterns.

Workaround:

• Add the following code to the theme’s functions.php to sanitize redirect parameters:

add_action('init', function() {
    if (isset($_GET['element-ready-redirect'])) {
        $url = $_GET['element-ready-redirect'];
        $allowed_hosts = array('example.com');
        $parsed = parse_url($url);
        if (!in_array($parsed['host'], $allowed_hosts)) {
            wp_die('Invalid redirect target.');
        }
    }
});

Valters IT
Securing Digital Frontiers