CVE-2024-10329

Executive Summary

CVE-2024-10329 is a sensitive information exposure vulnerability in the Ultimate Bootstrap Elements for Elementor WordPress plugin. The flaw resides in the ube_get_page_templates function, which fails to properly restrict access to private templates. An authenticated attacker with at least Contributor-level privileges can exploit this to extract the contents of private templates, potentially revealing sensitive data such as API keys, internal URLs, or proprietary design logic. The vulnerability affects all versions up to and including 1.4.6. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the WordPress ecosystem’s widespread use, this vulnerability should be addressed proactively.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. Therefore, no supply chain package security analysis is applicable beyond standard WordPress plugin update practices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker must have Contributor-level access or higher.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (private template contents).
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium (CVSS 4.3). While the confidentiality impact is low, the exposure of private templates could lead to further attacks if sensitive data is leaked.

Deep Dive & Mechanics

The vulnerability is located in the ube_get_page_templates function within the Ultimate Bootstrap Elements for Elementor plugin. This function is intended to retrieve a list of available page templates for use in the Elementor builder. However, it does not properly check the post_status or post_type of the templates it returns. Specifically, it fails to filter out private or draft templates, allowing any authenticated user with Contributor-level access to enumerate and read the contents of templates that are marked as private.

The function likely uses a WP_Query or get_posts() call without appropriate post_status filtering (e.g., only publish). By default, WordPress allows users with edit capabilities to see private posts of the same post type, but the plugin’s function may be exposing these without proper capability checks.

Attack Flow:

1. An attacker authenticates as a Contributor-level user.
2. The attacker sends a crafted request to the WordPress REST API or AJAX endpoint that triggers ube_get_page_templates.
3. The function returns a list of templates, including those with post_status set to private.
4. The attacker can then view the content of these private templates, potentially extracting sensitive information.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be in the ube_get_page_templates function. A patched version would need to add proper capability checks and filter by post_status.

Vulnerable Code (Conceptual):

function ube_get_page_templates() {
    $templates = get_posts( array(
        'post_type' => 'elementor_library',
        'numberposts' => -1,
    ) );
    return $templates;
}

Patched Code (Conceptual):

function ube_get_page_templates() {
    if ( ! current_user_can( 'edit_posts' ) ) {
        return array();
    }
    $templates = get_posts( array(
        'post_type' => 'elementor_library',
        'post_status' => 'publish',
        'numberposts' => -1,
    ) );
    return $templates;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Ultimate Bootstrap Elements for Elementor plugin version <= 1.4.6.
• A Contributor-level user account.

Exploitation Steps:

1. Log in as a Contributor.
2. Identify the AJAX action or REST endpoint that calls ube_get_page_templates. This is typically wp_ajax_ube_get_page_templates or a REST route.
3. Send a request to the endpoint. For example, using a browser console or curl:

   curl -X POST 'https://target.com/wp-admin/admin-ajax.php' \
   -d 'action=ube_get_page_templates' \
   --cookie 'wordpress_logged_in_...=...'
   

4. Parse the response to extract private template data.

Expected Output: The response will contain an array of template objects, including those with post_status set to private. The attacker can then view the content of these templates via the WordPress admin interface or by directly querying the post ID.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the action parameter set to ube_get_page_templates from Contributor-level users.
• Look for patterns where a user with low privileges (Contributor) is accessing template data that should be restricted.

Defense:

• Immediately update the plugin if a patch becomes available.
• As a temporary workaround, disable the plugin or restrict access to the ube_get_page_templates function via a custom plugin or code snippet.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=ube_get_page_templates from non-admin users.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with parameter action=ube_get_page_templates.
• Logs: WordPress debug logs showing ube_get_page_templates function calls by users with role contributor.
• File: Presence of private template content in unexpected locations (e.g., in browser cache or server logs).

Detection Engineering

YARA Rule

rule CVE_2024_10329_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2024-10329 in WordPress"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10329"
    strings:
        $ajax_action = "ube_get_page_templates"
        $wp_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $wp_ajax
}

Sigma Rule

title: CVE-2024-10329 - Sensitive Information Exposure via ube_get_page_templates
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2024-10329 in WordPress
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10329
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ube_get_page_templates'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10329 - WordPress Plugin Sensitive Information Exposure";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=ube_get_page_templates";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict Contributor-level access to only trusted users.
3. Implement a WAF rule to block the specific AJAX action for non-admin users.

Long-term Fix:

• Monitor the plugin’s official repository for a patched version (>= 1.4.7).
• Apply the patch as soon as it is released.
• Conduct a security review of all WordPress plugins in use.

Workaround Code Snippet: Add the following to your theme’s functions.php file to block the vulnerable function:

add_action( 'wp_ajax_ube_get_page_templates', function() {
    if ( ! current_user_can( 'administrator' ) ) {
        wp_die( 'Unauthorized.' );
    }
}, 1 );

Valters IT
Securing Digital Frontiers