CVE-2024-5229Discovered Published
Primary Addon for Elementor stored XSS
View patch bundle on GitHubFull published report
The reviewed summary below describes the scope of the fixture testing.
Primary Addon for Elementor stored XSS (CVE-2024-5229)
cve.now entry. Product: Primary Addon for
Elementor (lab: gabriel-elementor-app2).
Eden terminates the HTTP connection to the affected product, evaluates a declarative policy and — in tier 2 — a separately compiled native Rust module under signed module authority, before any byte reaches the application. It does not patch the affected component; the vendor's fixed release remains the durable repair.
Status: Remediated (tier 1 + tier 2), live-proven 2026-11-11T16:48:50Z on the
installed eden-product-release:1.103.0 lab container.
The vulnerability
The Primary Addon for Elementor saves a caller-supplied widget field unescaped,
persisting markup. The fixture (make_tplink22) reproduces the shape: an
admin-ajax save whose widget member carries a raw tag (<s>) records a
stored-XSS mark.
The Eden patch
Tier 1 — declarative policy (blunt, fail-closed): deny every request under
/wp-admin/admin-ajax.php, ordinary widget saves included — false positives
measured below.
Tier 2 — native Rust module gabriel_tplink28_v1 (surgical): refuses
save bodies carrying raw script-opening markers (<s>); ordinary widget
fields pass unchanged.
Measured comparison (fixtures9, run 2026-11-11)
| Probe | Baseline | Tier 1 | Tier 2 (module) | Backend effect |
|---|---|---|---|---|
benign widget save {"w":"w"} | 200 | 403 (false positive) | 200 | none |
attack: raw markup {"w":"<s>"} | 200 (xss_stored4 recorded) | 403 | 403 | blocked at tier 2 |
Performance trace (Eden telemetry, live 2026-11-11)
Measured with Eden's built-in request telemetry (gateway.request.baseline
spans, read back through /api/v1/analytics/telemetry?signal=traces), not
client wall-clock. Latency Eden introduces per remediation arm for this case:
| Arm | n | mean | p50 | p95 | min–max |
|---|---|---|---|---|---|
| Tier 1 — declarative policy, blocked request (403) | 15 | 35 µs | 31 µs | 78 µs | 19 µs–78 µs |
| Tier 2 — native module, benign passes through (200) | 22 | 372 µs | 355 µs | 487 µs | 309 µs–680 µs |
| Tier 2 — native module, attack refused (403) | 14 | 133 µs | 122 µs | 270 µs | 107 µs–270 µs |
Eden-added latency for the tier-2 remediation: benign requests complete in 372 µs mean (p50 355 µs, p95 487 µs) in-product, module evaluation included. Honest scope: lab fixtures on one host, fresh connection per measured request, warm requests only; module reactivated shards 2/2 with a fresh signed statement per measurement; spans carry the full authority lineage (module SHA-256, operation, publication). Not the EDEN-3640 performance qualification contract.
Tested against: eden-product-release:1.103.0-single (image sha256:809293e1f0b525ac…, build target
eden_service_single, tooling revision 81a0724a…). Raw data:
module2/telemetry-ab/tplink28-telemetry.json and module2/tier1-ab/tplink28-tier1.json.
Authority lifecycle and negatives
Import 201, activation: explicit_required; publisher enroll_key, host
inventory + approve, reader inspect refused 403; tampered-statement admit
400; invalid-signature admit 403; admit prepared (not serving), activate
→ receipt serving_now, applied shards 2/2. Revoke → the identical attack
gets 503 (fail-closed); re-approve + re-activate → 403 again. All recorded
in the evidence JSON.
Honest scope
The fixture reproduces the unescaped-widget shape, not the full addon surface.
Bypass variants (alternate tags, encoded payloads) are not bypass-tested; the
rule is a lab-grade partial. Module binary SHA-256 cc61ab8b…, source
modules/gabriel_tplink28_v1.rs.
Cost record
Run window 16:48:50Z → 16:48:58Z (per-CVE ledger, marginal session cost).
Evidence appendix
- Fixture:
gabriel-2026-11-11/fixtures9.py(make_tplink22, port 18310) - Evidence:
gabriel-2026-11-11/module2/evidence/tplink28-module.json - Module source:
docs/case-studies/modules/gabriel_tplink28_v1.rs
The vulnerability
The Primary Addon for Elementor saves a caller-supplied widget field unescaped,
persisting markup. The fixture (make_tplink22) reproduces the shape: an
admin-ajax save whose widget member carries a raw tag (<s>) records a
stored-XSS mark.
The Eden patch
Tier 1 — declarative policy (blunt, fail-closed): deny every request under
/wp-admin/admin-ajax.php, ordinary widget saves included — false positives
measured below.
Tier 2 — native Rust module gabriel_tplink28_v1 (surgical): refuses
save bodies carrying raw script-opening markers (<s>); ordinary widget
fields pass unchanged.
Measured comparison (fixtures9, run 2026-11-11)
| Probe | Baseline | Tier 1 | Tier 2 (module) | Backend effect |
|---|---|---|---|---|
benign widget save {"w":"w"} | 200 | 403 (false positive) | 200 | none |
attack: raw markup {"w":"<s>"} | 200 (xss_stored4 recorded) | 403 | 403 | blocked at tier 2 |
Performance trace (Eden telemetry, live 2026-11-11)
Measured with Eden's built-in request telemetry (gateway.request.baseline
spans, read back through /api/v1/analytics/telemetry?signal=traces), not
client wall-clock. Latency Eden introduces per remediation arm for this case:
| Arm | n | mean | p50 | p95 | min–max |
|---|---|---|---|---|---|
| Tier 1 — declarative policy, blocked request (403) | 15 | 35 µs | 31 µs | 78 µs | 19 µs–78 µs |
| Tier 2 — native module, benign passes through (200) | 22 | 372 µs | 355 µs | 487 µs | 309 µs–680 µs |
| Tier 2 — native module, attack refused (403) | 14 | 133 µs | 122 µs | 270 µs | 107 µs–270 µs |
Authority lifecycle and negatives
Import 201, activation: explicit_required; publisher enroll_key, host
inventory + approve, reader inspect refused 403; tampered-statement admit
400; invalid-signature admit 403; admit prepared (not serving), activate
→ receipt serving_now, applied shards 2/2. Revoke → the identical attack
gets 503 (fail-closed); re-approve + re-activate → 403 again. All recorded
in the evidence JSON.
Honest scope
The fixture reproduces the unescaped-widget shape, not the full addon surface.
Bypass variants (alternate tags, encoded payloads) are not bypass-tested; the
rule is a lab-grade partial. Module binary SHA-256 cc61ab8b…, source
modules/gabriel_tplink28_v1.rs.
Cost record
Run window 16:48:50Z → 16:48:58Z (per-CVE ledger, marginal session cost).