CVE-2024-0984

Executive Summary

CVE-2024-0984 is a missing authorization vulnerability in the ImageRecycle pdf & image compression plugin for WordPress. The vulnerability resides in the disableOptimization function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access or higher to disable the image optimization setting without authorization. The vulnerability affects all versions up to and including 3.1.13. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (Disabling optimization)
• Availability Impact: None

Threat Level: Medium. While the impact is limited to disabling a non-critical feature, the low attack complexity and low privileges required make it a viable target for automated attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The disableOptimization function in the ImageRecycle plugin is intended to be accessible only to administrators or users with specific capabilities. However, the function does not perform a current_user_can() check or any other authorization verification before executing the action.

Attack Flow:

1. An attacker authenticates to the WordPress site with subscriber-level credentials (or higher).
2. The attacker sends a crafted POST request to the vulnerable endpoint (likely /wp-admin/admin-ajax.php with an action parameter).
3. The disableOptimization function executes, disabling the image optimization setting.
4. The change persists, potentially degrading site performance or increasing storage usage.

Root Cause: The developer omitted the capability check, assuming only administrators would access the function. This is a common oversight in WordPress plugin development.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.1.13):

function disableOptimization() {
    update_option('imagerecycle_disable_optimization', true);
    wp_die();
}
add_action('wp_ajax_disable_optimization', 'disableOptimization');

Patched Code (Hypothetical):

function disableOptimization() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    update_option('imagerecycle_disable_optimization', true);
    wp_die();
}
add_action('wp_ajax_disable_optimization', 'disableOptimization');

The patched version adds a current_user_can('manage_options') check, restricting the function to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ImageRecycle plugin version <= 3.1.13.
• Valid subscriber-level credentials (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Log in to the WordPress site as a subscriber.
2. Obtain a valid nonce if required (check the plugin's AJAX handler).
3. Send the following request using curl:

curl -X POST \
  -d "action=disable_optimization" \
  -c cookies.txt \
  -b cookies.txt \
  http://target.com/wp-admin/admin-ajax.php

Expected Result: The image optimization setting is disabled. Verify by checking the imagerecycle_disable_optimization option in the database.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with the action=disable_optimization parameter.
2. Alert on requests from non-admin users (subscriber, contributor, author, editor).
3. Check the imagerecycle_disable_optimization option in the wp_options table for unexpected changes.

Response:

• Immediately revoke the attacker's access.
• Re-enable the optimization setting via the admin dashboard.
• Apply the patch or update the plugin when available.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/imagerecycle-pdf-image-compression/imagerecycle.php (or similar main plugin file)
• Database Option: imagerecycle_disable_optimization set to 1 (true)
• Log Entry: POST request to /wp-admin/admin-ajax.php with action=disable_optimization from a non-admin user
• User Agent: Any standard browser or curl user agent

Detection Engineering

YARA Rule

rule CVE_2024_0984_Imagerecycle_Missing_Auth {
    meta:
        description = "Detects vulnerable ImageRecycle plugin code with missing capability check"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0984"
    strings:
        $func = "function disableOptimization()" ascii wide nocase
        $ajax = "wp_ajax_disable_optimization" ascii wide nocase
        $no_check = "update_option('imagerecycle_disable_optimization'" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-0984 - ImageRecycle Plugin Missing Authorization
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized attempts to disable image optimization via AJAX
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=disable_optimization'
        cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-0984 - ImageRecycle Plugin Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=disable_optimization"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict access to the vulnerable function via a custom plugin or .htaccess rule.
2. Monitor logs for unauthorized AJAX requests to disable_optimization.
3. Change all user passwords if compromise is suspected.

Long-term Fix:

• Apply the vendor patch when released.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=disable_optimization from non-admin users.
• Conduct a code review of the plugin for similar missing authorization issues.

Workaround: Add the following code to a custom plugin or theme's functions.php to block unauthorized access:

add_action('wp_ajax_disable_optimization', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
}, 0);

Valters IT
Securing Digital Frontiers