CVE-2024-6340

Executive Summary

CVE-2024-6340 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Premium Addons for Elementor WordPress plugin, developed by Leap13. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the plugin's Countdown widget. The injected scripts execute whenever a user accesses the compromised page. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes. The issue is present in all versions up to and including 4.10.36, with a full patch released in version 4.10.37.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Premium Addons for Elementor plugin. There is no associated NPM, PyPI, Go, or Ruby package. The risk is limited to WordPress sites using the vulnerable plugin version. Users should update to version 4.10.37 or later to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): Low - The attacker needs contributor-level access or higher.
• User Interaction (UI): Required - The victim must visit the compromised page.
• Scope (S): Changed - The vulnerability can affect resources beyond the vulnerable component.
• Confidentiality (C): Low - Limited information disclosure is possible.
• Integrity (I): Low - Limited modification of data is possible.
• Availability (A): None - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used plugin like Premium Addons for Elementor increases the risk, especially for sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability resides in the Countdown widget of the Premium Addons for Elementor plugin. The widget allows users to set various attributes, such as the countdown date and time. Due to insufficient input sanitization and output escaping, an attacker with contributor-level access can inject malicious JavaScript code into these attributes. When the widget is rendered on a page, the injected script is executed in the context of the victim's browser.

The attack flow is as follows:

1. An authenticated attacker with contributor-level access or higher creates or edits a page using the Elementor page builder.
2. The attacker adds the Countdown widget and injects malicious JavaScript into a user-supplied attribute (e.g., the date attribute).
3. The attacker publishes the page.
4. When any user (including administrators) visits the page, the injected script executes, potentially stealing cookies, redirecting to malicious sites, or performing other actions.

The vulnerability is stored in the database, meaning the malicious script persists until the page is removed or the plugin is patched.

Vulnerable vs. Patched Code

The vulnerable code likely lacks proper escaping of user-supplied attributes in the Countdown widget. The patch in version 4.10.37 introduces proper sanitization and escaping functions.

Vulnerable Code (Conceptual):

// In the widget's render method
$date = $settings['date'];
echo '<div class="premium-countdown" data-date="' . $date . '">';

Patched Code (Conceptual):

// In the widget's render method
$date = esc_attr($settings['date']);
echo '<div class="premium-countdown" data-date="' . $date . '">';

The esc_attr() function escapes the output, preventing the injection of arbitrary HTML or JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the Premium Addons for Elementor plugin version <= 4.10.36.
• An account with contributor-level access or higher.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Pages > Add New.
3. Edit the page with Elementor.
4. Search for the "Countdown" widget and drag it onto the page.
5. In the widget settings, locate the date attribute (or another user-supplied attribute).
6. Inject the following payload into the attribute:

   " onfocus="alert('XSS')" autofocus="
   

   This payload will execute when the element receives focus.
7. Update and publish the page.
8. When any user visits the page, the script executes.

Alternative Payload:

" onmouseover="alert('XSS')" style="position:absolute;width:100%;height:100%;top:0;left:0;"

Blue Team

Detection Steps:

1. Monitor for unusual changes to pages by contributor-level users.
2. Review page content for suspicious JavaScript in widget attributes.
3. Check for the presence of the vulnerable plugin version (<= 4.10.36).
4. Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately update the plugin to version 4.10.37 or later.
• If immediate update is not possible, disable the Countdown widget temporarily.
• Review and remove any pages that may have been compromised.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/premium-addons-for-elementor/ (presence of vulnerable version)
• Database: Pages containing the Countdown widget with suspicious attributes (e.g., data-date containing JavaScript)
• Network: Outbound connections from the site to unknown domains (if the payload exfiltrates data)
• Logs: Unusual page edits by contributor-level users

Detection Engineering

YARA Rule

rule CVE_2024_6340_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Premium Addons for Elementor Countdown widget"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-6340"
    strings:
        $payload1 = /<div[^>]*class="[^"]*premium-countdown[^"]*"[^>]*data-date="[^"]*"/i
        $payload2 = /onfocus=|onmouseover=|onload=|onerror=/i
    condition:
        $payload1 and $payload2
}

Sigma Rule

title: Stored XSS via Premium Addons for Elementor Countdown Widget
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via the Countdown widget in Premium Addons for Elementor
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "premium-countdown"
        http.request_body|contains: "data-date"
    condition: selection
falsepositives:
    - Legitimate use of the Countdown widget with valid dates
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6340 - Stored XSS in Premium Addons for Elementor Countdown Widget"; flow:to_server,established; content:"premium-countdown"; http_uri; content:"data-date"; http_client_body; pcre:"/(onfocus|onmouseover|onload|onerror)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Premium Addons for Elementor plugin to version 4.10.37 or later.
2. If an immediate update is not possible, disable the Countdown widget by removing or commenting out the relevant code in the plugin files.
3. Review all pages created or edited by contributor-level users for suspicious content.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block XSS payloads.
• Enforce the principle of least privilege for user roles.
• Regularly update all plugins and themes.
• Conduct security audits of custom code and third-party plugins.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For further inquiries, contact intelligence@valters.it.