CVE-2024-50452

Executive Summary

CVE-2024-50452 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Nexter Blocks (also known as the-plus-addons-for-block-editor) developed by POSIMYTH. The vulnerability affects all versions up to and including 3.3.3. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into web pages via improperly neutralized input. When an administrator or other user views the compromised page, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this vulnerability in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: Required (UI:R) – victim must visit the compromised page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. Exploitation requires authenticated access, but the impact is limited to low-level data exposure and partial integrity loss. However, in a WordPress multisite environment or with elevated privileges, the impact could escalate.

Deep Dive & Mechanics

The vulnerability exists in the Nexter Blocks plugin, which extends the WordPress block editor (Gutenberg) with additional custom blocks. The plugin fails to properly sanitize user-supplied input when rendering certain block attributes or shortcodes. An attacker with contributor-level access can craft a post or page containing a malicious block that stores unsanitized JavaScript in the WordPress database. When the page is loaded by any user (including administrators), the stored script executes in the context of the victim’s browser.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, or directly outputs user input without applying esc_html() or wp_kses() with appropriate allowed HTML tags. This allows injection of <script> tags or event handlers like onload, onerror, etc.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or page and inserts a vulnerable Nexter Blocks block.
3. Attacker injects malicious JavaScript into a block attribute (e.g., className, content, or custom field).
4. The malicious payload is stored in the WordPress database.
5. When an administrator or other user views the post, the script executes.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (example from plugin):

// Vulnerable: direct output without sanitization
echo '<div class="' . $block_attributes['custom_class'] . '">' . $block_content . '</div>';

Patched Code (recommended fix):

// Patched: sanitize output
echo '<div class="' . esc_attr( $block_attributes['custom_class'] ) . '">' . wp_kses_post( $block_content ) . '</div>';

The patched version uses esc_attr() for HTML attributes and wp_kses_post() for block content, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Nexter Blocks <= 3.3.3
• Contributor-level account or higher

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post.
3. Switch to the block editor and add a Nexter Blocks block (e.g., "Heading" or "Button").
4. In the block settings, inject a payload into a text field, such as:

   "><script>alert('XSS')</script>
   

5. Publish or save the post as a draft.
6. Send the post URL to an administrator or wait for them to visit the post.

Example Payload (stored in a block attribute):

<img src=x onerror=alert(document.cookie)>

Note: No public exploit code is available. The above is a generic demonstration.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor WordPress logs for unusual post creation by low-privilege users.
2. Scan the database for suspicious script tags in wp_posts.post_content:

   SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror%' OR post_content LIKE '%onload%';
   

3. Use a web application firewall (WAF) to block common XSS patterns.

Response:

• Immediately disable the Nexter Blocks plugin if no patch is available.
• Remove any malicious posts or pages.
• Reset credentials of affected users.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified plugin files in /wp-content/plugins/the-plus-addons-for-block-editor/
  • Suspicious entries in wp_posts.post_content containing <script>, onerror, onload, or javascript:.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual JavaScript files loaded from external sources.

• Behavioral Indicators:

  • Posts created by contributor accounts with unusual block configurations.
  • Unexpected admin actions (e.g., new admin user creation) after visiting a compromised page.

Detection Engineering

YARA Rule

rule CVE_2024_50452_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Nexter Blocks plugin content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50452"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS in Nexter Blocks Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts created by Nexter Blocks plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        post_content|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50452 Stored XSS in Nexter Blocks"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any malicious content from the database (scan wp_posts for XSS patterns).
3. Review user accounts and remove any suspicious contributors.

Long-Term Fix:

• Apply the official patch when released by POSIMYTH.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce the principle of least privilege for WordPress users.

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Manually sanitize plugin output by editing the plugin files (not recommended for non-developers).

Valters IT
Securing Digital Frontiers