CVE-2024-0710

Executive Summary

CVE-2024-0710 is a vulnerability in the GP Unique ID WordPress plugin (versions up to and including 1.5.5) that allows unauthenticated attackers to tamper with the generation of a unique ID during form submission. The root cause is insufficient input validation, enabling an attacker to replace the system-generated unique ID with a user-controlled value. This leads to a loss of integrity in security-specific contexts where the uniqueness of the ID is relied upon (e.g., anti-CSRF tokens, session identifiers, or transaction IDs). The CVSS score is 5.3 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The GP Unique ID plugin is distributed via the WordPress Plugin Directory. Users should verify they are not running version 1.5.5 or earlier. No official patch has been released, and the vendor's status is unknown. Supply chain risk is elevated due to the lack of a patch and the plugin's potential use in security-critical contexts.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the impact is limited to integrity loss, the lack of authentication requirements and the potential for chaining with other vulnerabilities (e.g., CSRF bypass, IDOR) increases the risk.

Deep Dive & Mechanics

The GP Unique ID plugin generates a unique identifier for each form submission, intended to prevent duplicate submissions or provide a reference ID. The vulnerability lies in the plugin's failure to properly validate the input that controls the ID generation process. An unauthenticated attacker can intercept the form submission request and modify the parameter responsible for the unique ID, replacing it with a value of their choosing.

Technical Flow:

1. A user submits a form that triggers the plugin's ID generation function.
2. The plugin generates a unique ID (e.g., a UUID or timestamp-based hash) and stores it in the database.
3. Due to insufficient input validation, the plugin accepts a user-supplied parameter (e.g., gp_unique_id) that overrides the generated ID.
4. An attacker can set this parameter to a known value, causing the system to store and use the attacker-controlled ID.

Impact in Security Contexts:

• If the ID is used as an anti-CSRF token, an attacker can predict and reuse it.
• If the ID is used for session tracking, an attacker can hijack or fixate sessions.
• If the ID is used for transaction verification, an attacker can replay or manipulate transactions.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main processing function. A typical vulnerable pattern might look like:

Vulnerable Code (PHP):

$unique_id = $_POST['gp_unique_id'] ?: generate_unique_id();
// No validation of $unique_id

Patched Code (Hypothetical):

$unique_id = generate_unique_id();
// Do not accept user input for the ID
// Or validate that the user-supplied ID matches a generated one
if (isset($_POST['gp_unique_id']) && !validate_id($_POST['gp_unique_id'])) {
    // Reject or log
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with GP Unique ID plugin version <= 1.5.5.
• A form that uses the plugin to generate a unique ID.

Exploitation Steps:

1. Identify the form submission endpoint (e.g., /wp-admin/admin-ajax.php or a custom endpoint).
2. Intercept the request using a proxy (e.g., Burp Suite).
3. Locate the parameter that controls the unique ID (likely gp_unique_id or similar).
4. Modify the parameter to a known value (e.g., attacker-controlled-id).
5. Submit the request.
6. Verify that the system stores the attacker-controlled ID.

Example cURL Command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=submit_form&gp_unique_id=attacker-controlled-id&other_field=value"

Blue Team (Defender)

Detection:

• Monitor for form submissions where the gp_unique_id parameter is present and does not match expected patterns (e.g., UUID format).
• Look for repeated submissions with the same gp_unique_id value from different sessions.

Mitigation:

• Disable or remove the GP Unique ID plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests containing a user-supplied gp_unique_id parameter.
• Use a custom plugin that generates IDs server-side without accepting user input.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing gp_unique_id parameter with a non-standard value (e.g., not a UUID).
  • Repeated submissions with identical gp_unique_id values.
• Host:
  • Database entries where the unique ID field contains predictable or attacker-controlled values.
  • Log entries showing form submissions with modified gp_unique_id parameters.
• File:
  • Modified plugin files (if attacker gains write access).

Detection Engineering

YARA Rule

rule CVE_2024_0710_GP_Unique_ID {
    meta:
        description = "Detects exploitation attempts of CVE-2024-0710 in GP Unique ID plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0710"
    strings:
        $s1 = "gp_unique_id" nocase
        $s2 = "unique_id" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2024-0710 GP Unique ID Tampering
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to tamper with the GP Unique ID parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "gp_unique_id"
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0710 GP Unique ID Tampering Attempt"; flow:to_server; content:"gp_unique_id"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Apply a virtual patch using a WAF to block requests containing gp_unique_id in the POST body.
3. Monitor logs for any signs of exploitation.

Long-Term Fix:

• The vendor must release a patched version that removes the ability to override the generated ID with user input.
• Until then, consider replacing the plugin with an alternative that generates IDs server-side without accepting user input.

Workaround:

• Add a custom filter in WordPress to strip the gp_unique_id parameter from all requests:

add_filter('wp_handle_submission', function($data) {
    unset($data['gp_unique_id']);
    return $data;
});

Valters IT
Securing Digital Frontiers