CVE-2024-0868

Executive Summary

CVE-2024-0868 is a security advisory affecting the coreActivity: Activity Logging plugin for WordPress (WordPress ecosystem). The vulnerability allows an attacker to spoof the IP address logged by the plugin by manipulating HTTP headers such as X-Forwarded-For. This can lead to inaccurate logging, potentially masking the true origin of malicious activity and hindering forensic investigations. The plugin retrieves IP addresses from these headers without proper validation, enabling users to provide arbitrary values. The vendor, Coreactivity, has released version 2.1 to address this issue.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress software or web servers like Apache or Nginx. The plugin is distributed via the official WordPress plugin repository, and users are advised to update to the latest version from that source.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated low severity)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality Impact (C): None (N)
• Integrity Impact (I): Low (L) – Log integrity is compromised.
• Availability Impact (A): None (N)
• Threat Level: Low. The vulnerability does not allow direct system compromise but can be used to evade detection and complicate incident response.

Deep Dive & Mechanics

The coreActivity plugin logs user activities, including the originating IP address. To support environments behind reverse proxies or load balancers, the plugin reads IP addresses from HTTP headers like X-Forwarded-For, X-Real-IP, or Client-IP. The vulnerability arises because the plugin does not validate or sanitize these headers. An attacker can send a crafted HTTP request with a spoofed X-Forwarded-For header, causing the plugin to log a false IP address.

Root Cause: The plugin uses $_SERVER['HTTP_X_FORWARDED_FOR'] or similar without checking if the request actually came from a trusted proxy. This allows any client to inject arbitrary IP values.

Impact:

• Log Poisoning: Attackers can hide their real IP, making it difficult to trace malicious activities.
• False Attribution: Innocent users' IPs can be logged, potentially leading to false accusations.
• Bypass of IP-based restrictions: If the plugin is used for security decisions (e.g., blocking), attackers can bypass them.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.1):

// Example of vulnerable IP retrieval
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
// No validation or sanitization

Patched Code (version 2.1):

// Example of patched IP retrieval
$ip = $_SERVER['REMOTE_ADDR'];
// Or with trusted proxy validation
if (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && in_array($_SERVER['REMOTE_ADDR'], $trusted_proxies)) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
// Additional sanitization
$ip = filter_var($ip, FILTER_VALIDATE_IP);

The patch removes reliance on user-supplied headers or restricts them to trusted proxies only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with coreActivity plugin version < 2.1.
• Ability to send HTTP requests to the target.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a request with a spoofed X-Forwarded-For header:

   curl -H "X-Forwarded-For: 192.168.1.100" http://target-site.com/wp-admin/admin-ajax.php?action=coreactivity_log
   

3. The plugin logs the activity with IP 192.168.1.100 instead of the attacker's real IP.
4. Repeat with different IPs to poison logs.

Note: No public exploit code is available; this is a simple header manipulation.

Blue Team

Detection:

• Monitor for multiple requests with different X-Forwarded-For values from the same source IP.
• Check if the REMOTE_ADDR matches the X-Forwarded-For value; if not, investigate.
• Use the YARA and Sigma rules below.

Hunting:

• Search logs for entries where X-Forwarded-For is present and does not match the actual client IP.
• Look for patterns of IP spoofing across multiple log entries.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with X-Forwarded-For header containing IPs that do not match the source IP.
  • Multiple requests from the same source with varying X-Forwarded-For values.
• Host:
  • WordPress activity logs showing IPs that are not from the actual client.
  • Plugin log entries with inconsistent IP addresses.

Detection Engineering

YARA Rule

rule coreActivity_IP_Spoofing {
    meta:
        description = "Detects attempts to exploit CVE-2024-0868 by spoofing IP via X-Forwarded-For"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0868"
    strings:
        $header = "X-Forwarded-For" nocase
        $plugin = "coreActivity" nocase
    condition:
        $header and $plugin
}

Sigma Rule

title: CoreActivity IP Spoofing via X-Forwarded-For
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with spoofed X-Forwarded-For headers targeting coreActivity plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "coreactivity"
        cs-headers|contains: "X-Forwarded-For"
    condition: selection
falsepositives:
    - Legitimate proxy usage
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0868 CoreActivity IP Spoofing Attempt"; flow:to_server; http.header; content:"X-Forwarded-For"; nocase; http.uri; content:"coreactivity"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Update the coreActivity plugin to version 2.1 or later from the WordPress plugin repository.
2. If immediate update is not possible, disable the plugin temporarily.

Long-term:

• Implement a Web Application Firewall (WAF) rule to block or log requests with suspicious X-Forwarded-For headers.
• Configure the web server to strip or overwrite X-Forwarded-For headers from external sources.
• Use only REMOTE_ADDR for logging unless behind a trusted proxy.

Workaround:

• Add the following to .htaccess to remove X-Forwarded-For from external requests:

  RequestHeader unset X-Forwarded-For
  

Valters IT