CVE-2024-10828

Executive Summary

CVE-2024-10828 is a critical PHP Object Injection vulnerability affecting the Advanced Order Export For WooCommerce WordPress plugin, versions up to and including 3.5.5. The vulnerability is triggered during order export when the "Try to convert serialized values" option is enabled. An unauthenticated attacker can inject a malicious PHP object via deserialization of untrusted input. The presence of a POP (Property Oriented Programming) chain in the plugin or its dependencies allows the attacker to delete arbitrary files on the server. This can lead to Remote Code Execution (RCE) if critical files like wp-config.php are deleted, causing the site to fail and potentially allowing code execution via a new installation or other means.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely. The CVSS score of 8.1 (High) reflects the ease of exploitation and the severe impact on integrity and availability.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It is not related to the underlying web server (Apache/Nginx) or PHP runtime, but rather to insecure deserialization practices within the plugin's code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated exploitation.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No direct data theft.
• Integrity Impact: High (I:H) – Arbitrary file deletion.
• Availability Impact: High (A:H) – File deletion can cause denial of service.

Threat Level: Critical due to unauthenticated remote exploitation leading to potential RCE.

Deep Dive & Mechanics

The vulnerability resides in the Advanced Order Export For WooCommerce plugin's export functionality. When the "Try to convert serialized values" option is enabled, the plugin uses PHP's unserialize() function on user-supplied input without proper sanitization. This allows an attacker to inject a serialized PHP object.

PHP Object Injection occurs when user input is passed to unserialize(). If a class with a __wakeup() or __destruct() magic method is available (a POP chain), the attacker can trigger arbitrary code execution. In this case, the POP chain allows for arbitrary file deletion.

Attack Flow:

1. Attacker crafts a malicious serialized PHP object that, when unserialized, triggers a POP chain.
2. The POP chain uses a class (e.g., WP_Filesystem_Direct or a custom class) to delete a file.
3. The attacker sends a request to the export endpoint with the malicious serialized data.
4. The plugin unserializes the data, executes the POP chain, and deletes the target file (e.g., wp-config.php).
5. If wp-config.php is deleted, WordPress can no longer connect to the database, causing a crash. An attacker could then potentially reinstall WordPress or exploit the broken state.

Key Classes Involved (Hypothetical POP Chain):

• WP_Filesystem_Direct::delete() – Can delete files.
• Any class with __destruct() that calls delete() on a controlled path.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a secure alternative.

Vulnerable Code (in class-advanced-order-export.php or similar):

// Vulnerable: unserialize without validation
$export_data = unserialize($user_input);

Secure Code (Patched):

// Secure: Use json_decode or validate input
$export_data = json_decode($user_input, true);
if (json_last_error() !== JSON_ERROR_NONE) {
    // Handle error
}

Alternatively, if serialization is required, use a whitelist of allowed classes:

$allowed_classes = ['stdClass', 'MySafeClass'];
$export_data = unserialize($user_input, ['allowed_classes' => $allowed_classes]);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with plugin version <= 3.5.5.
• "Try to convert serialized values" option enabled in plugin settings.

Exploit Steps:

1. Identify the export endpoint (e.g., /wp-admin/admin-ajax.php?action=advanced_order_export).
2. Craft a serialized PHP object that triggers a POP chain for file deletion.
3. Send a POST request with the malicious serialized data.

Example Payload (Conceptual):

// PHP code to generate payload
class POPChain {
    public $file_path = '/var/www/html/wp-config.php';
    public function __destruct() {
        unlink($this->file_path);
    }
}
$payload = serialize(new POPChain());
echo urlencode($payload);

Exploit Request (cURL):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=advanced_order_export&data=O:8:\"POPChain\":1:{s:9:\"file_path\";s:29:\"/var/www/html/wp-config.php\";}"

Note: The actual POP chain class names and structure depend on the plugin's code. This is a simplified example.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual serialized data in POST requests to export endpoints.
• Look for file deletion events (e.g., unlink() calls) on critical files.
• Use WAF rules to block serialized PHP objects.

Honeypot:

• Deploy a fake wp-config.php file and monitor for access/deletion attempts.

Log Analysis:

• Check PHP error logs for unserialize() errors.
• Monitor file integrity on critical paths.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-ajax.php with action=advanced_order_export and serialized PHP data (e.g., O:8:"POPChain":1:{...}).
  • Unusual User-Agent strings or repeated requests from the same IP.

• File System:

  • Deletion of wp-config.php, .htaccess, or other critical files.
  • Presence of unexpected files in wp-content/uploads/ or wp-content/plugins/.

• Logs:

  • PHP warnings: unserialize(): Error at offset ...
  • WordPress debug logs showing unlink() calls on unexpected paths.

Detection Engineering

YARA Rule

rule CVE_2024_10828_PHP_Object_Injection {
    meta:
        description = "Detects serialized PHP objects targeting CVE-2024-10828"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10828"
    strings:
        $serialized = /O:\d+:"[^"]+":\d+:\{/
        $file_delete = /unlink|delete|wp-config/
    condition:
        $serialized and $file_delete
}

Sigma Rule

title: CVE-2024-10828 - PHP Object Injection in Advanced Order Export
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-10828 via serialized PHP objects
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=advanced_order_export'
        cs-body: 'O:*'
    condition: selection
falsepositives:
    - Legitimate plugin usage with serialized data (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-10828 - PHP Object Injection in Advanced Order Export";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=advanced_order_export";
    http_client_body;
    pcre:"/O:\d+:\"[^\"]+\":\d+:\{/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Try to convert serialized values" option in the plugin settings.
2. If possible, temporarily deactivate the plugin until a patch is released.
3. Implement a Web Application Firewall (WAF) rule to block serialized PHP objects in POST requests.

Long-term Fix:

• The vendor must release a patched version that replaces unserialize() with json_decode() or uses allowed_classes parameter.
• Monitor the plugin's update channel for a security patch.

Compensating Controls:

• Restrict access to /wp-admin/admin-ajax.php via IP whitelisting or .htaccess.
• Enable file integrity monitoring (e.g., OSSEC, Tripwire) on critical WordPress files.
• Regularly backup wp-config.php and other critical files.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert