CVE-2024-10356

Executive Summary

CVE-2024-10356 is a Sensitive Information Exposure vulnerability in the ElementsReady Addons for Elementor WordPress plugin, affecting all versions up to and including 6.4.8. The flaw resides in the inc/Widgets/accordion/output/content.php file, allowing authenticated attackers with Contributor-level access or higher to extract sensitive private, pending, and draft template data. This exposure can lead to information disclosure of unpublished content, potentially revealing business logic, proprietary designs, or sensitive user data.

The vulnerability is classified as WordPress ecosystem issue, not related to Apache or Nginx. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood currently. No public exploit code or patch is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor the plugin’s update channel for a patched version. Since no patch is available, manual code review and access control hardening are recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but allows low-privileged users to access sensitive data. The lack of public exploit and low EPSS score reduces immediate risk, but the information disclosure could be leveraged in further attacks.

Deep Dive & Mechanics

The vulnerability exists in the inc/Widgets/accordion/output/content.php file of the ElementsReady Addons plugin. The plugin’s accordion widget fails to properly restrict access to template data when rendering content. Specifically, the code does not check the post status (e.g., private, pending, draft) before outputting template content. This allows authenticated users with Contributor-level access (who can create and edit posts) to view sensitive template data that should be restricted.

The flaw is a classic Insecure Direct Object Reference (IDOR) combined with Information Exposure (CWE-200). The plugin likely retrieves template data by ID without verifying the user’s permissions to view that specific template’s status.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 6.4.8):

// inc/Widgets/accordion/output/content.php
$template_id = get_post_meta(get_the_ID(), 'accordion_template_id', true);
$template_content = get_post_field('post_content', $template_id);
echo $template_content; // No permission check

Patched Code (hypothetical):

// inc/Widgets/accordion/output/content.php
$template_id = get_post_meta(get_the_ID(), 'accordion_template_id', true);
if (current_user_can('read_private_posts') || get_post_status($template_id) === 'publish') {
    $template_content = get_post_field('post_content', $template_id);
    echo $template_content;
} else {
    // Return empty or error
}

The patch would add a capability check to ensure the user has permission to read private posts or that the template is published.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress user with Contributor role or higher.
2. Steps:
   • Log in to WordPress.
   • Navigate to a page or post using the ElementsReady accordion widget.
   • Inspect the page source or use browser developer tools to identify the template ID used.
   • Craft a request to the vulnerable endpoint (e.g., via AJAX or direct page load) that triggers the accordion widget to output template content.
   • Observe that private, pending, or draft template data is exposed.

Example Request:

GET /wp-json/elementsready/v1/accordion-content?template_id=123 HTTP/1.1
Host: target-site.com
Cookie: wordpress_logged_in_xxx=...

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Hardening)

1. Monitor Logs: Look for unusual access patterns to inc/Widgets/accordion/output/content.php or related AJAX endpoints.
2. Access Control: Restrict Contributor roles from accessing sensitive templates. Use a plugin like "User Role Editor" to remove unnecessary capabilities.
3. Code Review: Manually audit the plugin code for similar IDOR issues.
4. WAF Rules: Block requests with suspicious template_id parameters that attempt to access non-published posts.

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/elementsready-lite/inc/Widgets/accordion/output/content.php
• Log Entries: Repeated access to the above file with varying template_id parameters.
• Network Traffic: HTTP requests to /wp-json/elementsready/v1/accordion-content or similar endpoints.
• User Activity: Contributor-level users accessing template IDs that correspond to private/draft posts.

Detection Engineering

YARA Rule

rule Detect_ElementsReady_InfoDisclosure {
    meta:
        description = "Detects vulnerable ElementsReady Addons plugin files"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10356"
    strings:
        $vuln_file = "inc/Widgets/accordion/output/content.php"
        $vuln_func = "get_post_field"
    condition:
        $vuln_file and $vuln_func
}

Sigma Rule

title: CVE-2024-10356 - ElementsReady Addons Sensitive Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-10356
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "/wp-content/plugins/elementsready-lite/inc/Widgets/accordion/output/content.php"
            - "/wp-json/elementsready/v1/accordion-content"
    condition: selection
falsepositives:
    - Legitimate admin usage
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10356 - ElementsReady Addons Info Disclosure"; flow:to_server,established; content:"/wp-content/plugins/elementsready-lite/inc/Widgets/accordion/output/content.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the ElementsReady Addons plugin until a patch is available.
   • Restrict Contributor roles from accessing sensitive templates via custom code or role management plugins.
   • Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint.

2. Long-term Fix:

   • Apply the vendor patch when released.
   • Conduct a security audit of all plugins for similar IDOR issues.
   • Enforce principle of least privilege for all user roles.

3. Monitoring:

   • Enable detailed logging for WordPress REST API and plugin file access.
   • Set up alerts for unusual access patterns to template data.

Valters IT
DevSecOps & Cyber Threat Intelligence