CVE-2024-10111

Executive Summary

CVE-2024-10111 is a critical authentication bypass vulnerability in the WordPress plugin OAuth Single Sign On – SSO (OAuth Client) by Miniorange, affecting all versions up to and including 6.26.3. The flaw resides in insufficient verification of the user identity returned by the social login token, allowing an unauthenticated attacker to log in as any existing user on the site, including administrators. This is a WordPress ecosystem issue and does not involve Apache or Nginx. The CVSS score is 8.1 (High), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should treat this as a supply chain risk, as the plugin is a third-party component integrated into WordPress sites. No OSV or GitHub advisory data is available, and the patch status is unknown.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the low attack complexity and the potential for full site compromise.

Deep Dive & Mechanics

The vulnerability exists in the OAuth Single Sign On plugin's handling of social login tokens. When a user authenticates via an OAuth provider (e.g., Google, Facebook), the plugin receives a token containing user information. The flaw is that the plugin does not properly verify that the user returned by the token is the same user who initiated the login. Specifically, the plugin fails to validate the sub (subject) claim or equivalent unique identifier against the session or state parameter.

An attacker can exploit this by:

1. Obtaining a valid OAuth token from a provider (e.g., by registering a dummy account).
2. Manipulating the token or the callback request to specify a different username (e.g., admin).
3. The plugin, due to insufficient verification, logs the attacker in as that user.

The attack requires the attacker to know the target username and that the target user does not already have an account linked to the same OAuth provider. This is a classic authentication bypass via improper identity verification.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the OAuth callback handler. A typical vulnerable pattern might look like:

// Vulnerable code (pseudo)
$user_info = $oauth_provider->get_user_info($token);
$username = $user_info['username']; // Not verified against session
$user = get_user_by('login', $username);
if ($user) {
    wp_set_current_user($user->ID);
    wp_set_auth_cookie($user->ID);
}

A patched version would include verification:

// Patched code (pseudo)
$state = $_GET['state'];
$expected_state = get_transient('oauth_state_' . session_id());
if ($state !== $expected_state) {
    die('Invalid state');
}
$user_info = $oauth_provider->get_user_info($token);
$username = $user_info['username'];
// Verify that the user returned matches the state's intended user
$intended_user = get_transient('oauth_intended_user_' . session_id());
if ($username !== $intended_user) {
    die('User mismatch');
}
$user = get_user_by('login', $username);
if ($user) {
    wp_set_current_user($user->ID);
    wp_set_auth_cookie($user->ID);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin (<= 6.26.3) installed and configured with an OAuth provider.
• Knowledge of a target username (e.g., admin).
• Ability to register an account with the OAuth provider (e.g., Google).

Exploitation Steps:

1. Register a dummy account with the OAuth provider (e.g., attacker@gmail.com).
2. Initiate the OAuth login flow from the WordPress site.
3. Intercept the callback request (e.g., using Burp Suite).
4. Modify the username parameter in the callback to the target username (e.g., admin).
5. Forward the request. The plugin will log you in as the target user.

Example Request Modification:

POST /wp-login.php?action=oauth_callback HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

code=valid_code&state=valid_state&username=admin

Blue Team

Detection:

• Monitor for unusual OAuth callback requests where the username parameter differs from the expected user.
• Look for multiple failed login attempts followed by a successful OAuth login.
• Check for logins from IP addresses not associated with the legitimate user.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-login.php?action=oauth_callback*"
| rex field=uri "username=(?<username>\w+)"
| stats count by username, clientip
| where count > 1

Indicators of Compromise (IOCs)

• Network:
  • Unusual OAuth callback requests with manipulated username parameters.
  • Multiple OAuth login attempts from the same IP in a short period.
• Host:
  • New user sessions created without corresponding login events.
  • Unexpected administrator-level actions from non-admin IPs.
• Logs:
  • WordPress debug log entries showing oauth_callback with mismatched usernames.
  • Authentication logs showing logins via OAuth for users who normally use password authentication.

Detection Engineering

YARA Rule

rule CVE_2024_10111_OAuth_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-10111 in WordPress OAuth plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10111"
    strings:
        $s1 = "oauth_callback" nocase
        $s2 = "username=" nocase
        $s3 = "admin" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-10111 OAuth Authentication Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-10111 in WordPress OAuth plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "action=oauth_callback"
        cs-uri-query|contains: "username="
    condition: selection
falsepositives:
    - Legitimate OAuth logins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10111 OAuth Authentication Bypass"; flow:to_server,established; content:"/wp-login.php"; http_uri; content:"action=oauth_callback"; http_uri; content:"username="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement Web Application Firewall (WAF) rules to block suspicious OAuth callback requests.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from Miniorange once released.
• Consider using alternative OAuth plugins with proper identity verification.

Workaround:

• Add server-side validation to ensure the OAuth token's sub claim matches the expected user.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert