CVE-2024-5173

Executive Summary

CVE-2024-5173 is a Stored Cross-Site Scripting (XSS) vulnerability in the HT Mega – Absolute Addons For Elementor WordPress plugin, affecting all versions up to and including 2.5.5. The flaw resides in the Video player widget settings, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. No NPM, PyPI, Go, or Ruby packages are affected. The plugin is distributed via the WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must visit injected page)
• Scope: Changed (Impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access with contributor privileges, but the stored XSS can affect all site visitors, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the Video player widget of the HT Mega plugin. The widget allows users to set attributes such as video URL, autoplay, and other settings. Due to insufficient sanitization and output escaping, an attacker can inject malicious JavaScript into these attributes. When the widget is rendered on a page, the injected script executes in the context of the victim's browser.

Root Cause: The plugin fails to properly sanitize user input in the ht-mega-addons/elementor/widgets/video_player.php file (or similar). The esc_attr() or wp_kses() functions are not applied to certain attributes, allowing raw HTML/JavaScript to be stored and later rendered.

Attack Flow:

1. Attacker logs in with contributor-level access.
2. Creates or edits a page/post using Elementor.
3. Adds the HT Mega Video player widget.
4. Injects malicious JavaScript into a widget attribute (e.g., video_url or autoplay).
5. Publishes or saves the page.
6. Victim visits the page; the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.5.5):

// In video_player.php or similar
$video_url = $settings['video_url'];
echo '<div class="ht-video-player" data-url="' . $video_url . '">';

Here, $video_url is directly echoed without escaping.

Patched Code (hypothetical fix):

$video_url = esc_url( $settings['video_url'] );
echo '<div class="ht-video-player" data-url="' . $video_url . '">';

Or using wp_kses() for broader attribute sanitization.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with HT Mega plugin <= 2.5.5
• Contributor-level account or higher

Steps:

1. Log in to WordPress admin.
2. Navigate to Pages > Add New.
3. Edit with Elementor.
4. Search for "HT Video Player" widget.
5. In the widget settings, locate the "Video URL" field.
6. Inject payload: " onmouseover="alert('XSS')" or a more sophisticated script.
7. Save and publish the page.
8. Send link to victim.

Example Payload:

" onfocus="alert(document.cookie)" autofocus="true

Note: No public exploit code is available at this time.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual widget attribute values in page/post content.
• Look for on* event handlers in stored post meta.
• Use WAF rules to block common XSS patterns.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers.
• Use a WordPress security plugin with XSS filtering.
• Disable the Video player widget if not needed.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/ht-mega-for-elementor/elementor/widgets/video_player.php (or similar)
• Post Meta: _elementor_data containing malicious script tags or event handlers.
• Network: Outbound requests to attacker-controlled domains from compromised pages.
• Logs: Unusual wp_ajax_* or wp_post_* actions from contributor accounts.

Detection Engineering

YARA Rule

rule CVE_2024_5173_HT_Mega_XSS {
    meta:
        description = "Detects malicious payloads in HT Mega Video player widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5173"
    strings:
        $xss1 = /on\w+\s*=\s*["']?[^"']*["']?/ nocase
        $xss2 = /<script[^>]*>.*<\/script>/i
        $widget = "ht-video-player"
    condition:
        $widget and ($xss1 or $xss2)
}

Sigma Rule

title: CVE-2024-5173 HT Mega Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts in HT Mega Video player widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "ht-mega-for-elementor"
        http.body|contains: 
            - "onmouseover"
            - "onfocus"
            - "onload"
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5173 HT Mega Stored XSS Attempt"; flow:to_server,established; content:"ht-mega-for-elementor"; http_uri; pcre:"/(on\w+\s*=\s*[\x22\x27]?[^\x22\x27]*[\x22\x27]?|<script[^>]*>)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the HT Mega plugin until a patch is available.
2. Remove or sanitize any existing malicious content in pages/posts.
3. Review and restrict contributor-level accounts.

Long-term Fix:

• Apply vendor patch when released (currently UNKNOWN).
• Upgrade to version > 2.5.5 if available.
• Implement input validation and output escaping in custom code.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Add CSP headers: Content-Security-Policy: script-src 'self';
• Use WordPress security plugins like Wordfence or Sucuri.

Valters IT