CVE-2024-8267

Executive Summary

CVE-2024-8267 is a Stored Cross-Site Scripting (XSS) vulnerability in the Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player WordPress plugin, affecting all versions up to and including 2.0.78. The flaw resides in the wp:radio-player Gutenberg block, where the align attribute is not properly sanitized or escaped. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when any user views the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%), indicating low active exploitation in the wild. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor (Softlab). No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the requirement for authenticated access and the limited impact on confidentiality and integrity. However, the ability to inject persistent scripts can lead to session hijacking, defacement, or phishing attacks.

Deep Dive & Mechanics

The vulnerability exists in the Gutenberg block registration of the Radio Player plugin. The align attribute, which controls block alignment (e.g., left, center, right), is passed through user input without proper sanitization or output escaping. When the block is rendered on the frontend, the unsanitized align value is directly embedded into the HTML, allowing an attacker to inject arbitrary JavaScript.

Root Cause: Insufficient input sanitization and output escaping in the render_block function for the wp:radio-player block.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page.
2. The attacker inserts the wp:radio-player block and sets the align attribute to a malicious payload, e.g., " onmouseover="alert(1)".
3. The payload is stored in the database without proper sanitization.
4. When any user (including administrators) views the page, the injected script executes in their browser context.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.0.78):

// In the block render callback
function radio_player_render_block($attributes, $content) {
    $align = isset($attributes['align']) ? $attributes['align'] : '';
    // No sanitization or escaping
    return '<div class="wp-block-radio-player align' . $align . '">' . $content . '</div>';
}

Patched Code (hypothetical fix):

function radio_player_render_block($attributes, $content) {
    $align = isset($attributes['align']) ? esc_attr($attributes['align']) : '';
    return '<div class="wp-block-radio-player align' . $align . '">' . $content . '</div>';
}

The patched version uses esc_attr() to escape the align attribute, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Radio Player plugin version <= 2.0.78.
• User account with Contributor-level privileges or higher.

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post and add the wp:radio-player block.
3. In the block editor, switch to the "Code Editor" view.
4. Modify the block HTML to include a malicious align attribute:

   <!-- wp:radio-player {"align":"\" onmouseover=\"alert('XSS')\""} /-->
   

5. Publish or save the post.
6. When any user visits the post, the script executes on mouseover.

Alternative Payload (auto-execute):

<!-- wp:radio-player {"align":"\" onload=\"alert('XSS')\""} /-->

Blue Team

Detection:

• Monitor for posts containing the wp:radio-player block with unusual align values.
• Look for JavaScript event handlers (e.g., onmouseover, onload) in block attributes.

Prevention:

• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads in block attributes.
• Apply the principle of least privilege for user roles.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/radio-player/radio-player.php (check version)
• Database: Posts/pages containing wp:radio-player block with align attribute containing JavaScript event handlers.
• Network: Outbound requests from injected scripts (e.g., to attacker-controlled domains).
• Logs: WordPress audit logs showing creation/editing of posts by Contributor-level users with suspicious block attributes.

Detection Engineering

YARA Rule

rule CVE_2024_8267_Radio_Player_XSS {
    meta:
        description = "Detects malicious align attribute in Radio Player Gutenberg block"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8267"
    strings:
        $block = /<!-- wp:radio-player\s+[^>]*align\s*=\s*["'][^"']*["']\s*\/-->/ nocase
        $xss_payload = /on\w+\s*=\s*["'][^"']*["']/ nocase
    condition:
        $block and $xss_payload
}

Sigma Rule

title: CVE-2024-8267 - Stored XSS via Radio Player Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the wp:radio-player block align attribute
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wp:radio-player'
        http.url|re: 'align\s*=\s*["\'][^"\']*["\']'
    condition: selection
falsepositives:
    - Legitimate use of align attribute with safe values
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8267 - Stored XSS via Radio Player Plugin"; flow:to_server,established; content:"wp:radio-player"; http_uri; pcre:"/align\s*=\s*["\'][^"\']*["\']/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict Contributor-level access.
2. Apply a virtual patch using a WAF to block XSS payloads in block attributes.
3. Monitor for updates from Softlab and apply the patch as soon as it becomes available.

Long-term Fix:

• The vendor must implement proper input sanitization and output escaping for all block attributes, especially align.
• Use WordPress functions like esc_attr() and wp_kses_post() to sanitize user input.

Workaround:

• Remove Contributor-level access for untrusted users.
• Use a security plugin (e.g., Wordfence) to block XSS attempts.

Valters IT