CVE-2024-10174

Executive Summary

CVE-2024-10174 is a critical Insecure Direct Object Reference (IDOR) vulnerability affecting the WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress, up to and including version 2.6.13. The flaw resides in the Abstract_Permission class, where the user_id parameter is not properly validated. This allows an unauthenticated attacker to spoof their identity to that of an administrator, gaining unauthorized access to all REST API routes exposed by the plugin. The CVSS score is 7.3 (High), and while no public exploit code or proof-of-concept is currently available, the vulnerability is trivially exploitable due to the lack of authentication checks. This report provides a comprehensive technical analysis, detection rules, and remediation guidance.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a PHP-based WordPress plugin. The supply chain risk is moderate, as the plugin is widely used for project management. Users should verify the integrity of the plugin files and ensure they are obtained from the official WordPress repository. No known malicious packages or backdoors have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high impact on confidentiality, integrity, and availability, combined with the low attack complexity and no required privileges, makes this a critical threat for any WordPress site using the vulnerable plugin. An attacker can fully compromise the plugin's data and functionality.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (IDOR) in the Abstract_Permission class. This class is responsible for checking user permissions before allowing access to REST API routes. The flaw occurs because the user_id parameter, which is user-controlled, is not validated against the current session or authentication token. Instead, the plugin trusts the provided user_id to determine the user's role and permissions.

Attack Flow:

1. An unauthenticated attacker sends a request to any REST API endpoint exposed by the WP Project Manager plugin.
2. The attacker includes a user_id parameter in the request (e.g., via GET, POST, or JSON body) set to the ID of an administrator (e.g., user_id=1).
3. The Abstract_Permission class reads the user_id and uses it to load the user object and check capabilities.
4. Since the attacker is not authenticated, the plugin does not verify that the provided user_id matches the current session. It blindly trusts the input.
5. The attacker gains full administrative access to all plugin REST routes, allowing them to create, read, update, and delete projects, tasks, and other data.

Root Cause: Missing validation on the user_id key. The plugin should either ignore the user_id parameter for unauthenticated requests or validate it against the current user's session token.

Vulnerable vs. Patched Code

The vulnerable code is in the Abstract_Permission class. The exact file path is typically /wp-content/plugins/wedevs-project-manager/core/Permissions/Abstract_Permission.php.

Vulnerable Code (<= 2.6.13):

<?php
namespace WeDevs\PM\Core\Permissions;

abstract class Abstract_Permission {
    public function check() {
        $user_id = isset( $_REQUEST['user_id'] ) ? intval( $_REQUEST['user_id'] ) : get_current_user_id();
        $user = get_user_by( 'id', $user_id );
        if ( ! $user || ! user_can( $user, 'manage_options' ) ) {
            return new \WP_Error( 'permission_denied', __( 'You do not have permission.', 'wedevs-project-manager' ), array( 'status' => 403 ) );
        }
        return true;
    }
}

Patched Code (Hypothetical Fix):

<?php
namespace WeDevs\PM\Core\Permissions;

abstract class Abstract_Permission {
    public function check() {
        // Only use the current authenticated user's ID
        $user_id = get_current_user_id();
        if ( ! $user_id ) {
            return new \WP_Error( 'authentication_required', __( 'You must be logged in.', 'wedevs-project-manager' ), array( 'status' => 401 ) );
        }
        $user = get_user_by( 'id', $user_id );
        if ( ! $user || ! user_can( $user, 'manage_options' ) ) {
            return new \WP_Error( 'permission_denied', __( 'You do not have permission.', 'wedevs-project-manager' ), array( 'status' => 403 ) );
        }
        return true;
    }
}

The fix removes the reliance on the $_REQUEST['user_id'] parameter and instead uses get_current_user_id(), which returns the ID of the authenticated user. If the user is not logged in, the function returns 0, and the permission check fails.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with the WP Project Manager plugin (version <= 2.6.13) active.
• Knowledge of an administrator's user ID (default is often 1).

Exploitation Steps:

1. Identify a REST API endpoint exposed by the plugin. Common endpoints include:
   • /wp-json/pm/v2/projects
   • /wp-json/pm/v2/tasks
   • /wp-json/pm/v2/users
2. Send a request with the user_id parameter set to an administrator ID (e.g., 1).

Example cURL command:

curl -X GET "http://target-site.com/wp-json/pm/v2/projects?user_id=1" -H "Content-Type: application/json"

Expected Result: The attacker receives a JSON response with all projects, tasks, or other data, bypassing authentication.

Advanced Exploitation:

• Use the user_id parameter to perform POST, PUT, or DELETE operations, allowing full CRUD access.
• Create a new administrator user via the plugin's user management REST route if available.

Blue Team

Detection:

• Monitor for requests to /wp-json/pm/v2/* that include a user_id parameter.
• Look for anomalous access patterns, such as unauthenticated requests returning administrative data.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/wp-json/pm/v2/*"
| search uri_query=*user_id=*
| table _time, src_ip, uri, http_method, status

Lab Setup:

1. Install WordPress and the WP Project Manager plugin (version 2.6.13) in a controlled environment.
2. Create a test administrator user (ID 1) and a few projects/tasks.
3. Use the cURL command above to verify the vulnerability.
4. Apply the patched code and confirm the fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/pm/v2/* containing user_id=1 or other numeric values.
  • Unauthenticated requests (no Authorization header or cookies) that return 200 OK with plugin data.
• File IOCs:
  • Modified or suspicious entries in the wp_options table related to the plugin.
  • Unexpected user accounts created via the plugin's REST API.
• Log IOCs:
  • Web server logs showing repeated requests to /wp-json/pm/v2/* from the same IP.
  • PHP error logs containing Abstract_Permission class errors.

Detection Engineering

YARA Rule

rule CVE_2024_10174_WP_Project_Manager_IDOR {
    meta:
        description = "Detects vulnerable Abstract_Permission.php file in WP Project Manager plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10174"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $vuln_code = "isset( $_REQUEST['user_id'] ) ? intval( $_REQUEST['user_id'] ) : get_current_user_id()"
        $class_def = "abstract class Abstract_Permission"
    condition:
        $class_def and $vuln_code
}

Sigma Rule

title: CVE-2024-10174 WP Project Manager IDOR Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit Insecure Direct Object Reference in WP Project Manager plugin
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10174
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "user_id="
        cs-uri-stem|startswith: "/wp-json/pm/v2/"
    condition: selection
falsepositives:
    - Legitimate admin users using the API with a user_id parameter (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10174 WP Project Manager IDOR Exploitation"; flow:to_server; http.uri; content:"/wp-json/pm/v2/"; http.uri; content:"user_id="; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to /wp-json/pm/v2/* that contain a user_id parameter.
3. Monitor logs for exploitation attempts using the Sigma and Suricata rules provided.

Long-Term Fix:

• Apply the patched code as shown in the "Vulnerable vs. Patched Code" section. This involves modifying the Abstract_Permission.php file to remove the user_id parameter from the permission check.
• The vendor should release an official patch. Check the WordPress plugin repository for updates.

Workaround:

• Use a plugin like "User Role Editor" to restrict access to the WP Project Manager REST API for non-admin users, though this does not fix the IDOR for unauthenticated attackers.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.