CVE-2024-1091

Executive Summary

CVE-2024-1091 is a vulnerability in the ImageRecycle pdf & image compression plugin for WordPress, affecting all versions up to and including 3.1.13. The issue stems from a missing capability check on the reinitialize function, allowing authenticated attackers with subscriber-level access or higher to remove all plugin data. This unauthorized modification of data can lead to loss of configuration, logs, and potentially disrupt image compression services. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized data removal
• Availability Impact: None (A:N)

The threat level is considered Medium due to the low privileges required and the potential for data loss, though the impact is limited to plugin data only.

Deep Dive & Mechanics

The vulnerability exists in the reinitialize function of the ImageRecycle plugin. This function is intended to reset the plugin to its default state, but it lacks a proper capability check (e.g., manage_options or activate_plugins). As a result, any authenticated user with subscriber-level access or above can trigger this function via an AJAX request or direct call, leading to the deletion of all plugin data, including settings, logs, and cached data.

The missing capability check is a classic example of CWE-862: Missing Authorization. The plugin fails to verify that the user has the necessary permissions before executing the destructive action.

Vulnerable vs. Patched Code

The vulnerable code likely resembles:

add_action('wp_ajax_imagerecycle_reinitialize', 'imagerecycle_reinitialize_callback');
function imagerecycle_reinitialize_callback() {
    // Missing capability check
    delete_option('imagerecycle_settings');
    delete_option('imagerecycle_logs');
    // ... other cleanup
    wp_die();
}

A patched version would include a capability check:

add_action('wp_ajax_imagerecycle_reinitialize', 'imagerecycle_reinitialize_callback');
function imagerecycle_reinitialize_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    delete_option('imagerecycle_settings');
    delete_option('imagerecycle_logs');
    // ... other cleanup
    wp_die();
}

The patch ensures only users with manage_options capability (typically administrators) can reinitialize the plugin.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker with subscriber-level access can send a crafted AJAX request to the WordPress admin-ajax.php endpoint.

Step-by-step:

1. Obtain valid subscriber credentials (e.g., via phishing or weak passwords).
2. Log in to WordPress.
3. Send a POST request to /wp-admin/admin-ajax.php with the action parameter set to imagerecycle_reinitialize.

Example using cURL:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=imagerecycle_reinitialize" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

This will trigger the reinitialize function and remove all plugin data.

Blue Team

To detect exploitation attempts:

• Monitor for AJAX requests to admin-ajax.php with the action imagerecycle_reinitialize from non-admin users.
• Review server logs for unusual POST requests to /wp-admin/admin-ajax.php with the parameter action=imagerecycle_reinitialize.
• Implement Web Application Firewall (WAF) rules to block such requests from low-privileged users.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=imagerecycle_reinitialize from authenticated sessions with subscriber role.
• Logs: WordPress debug logs showing calls to imagerecycle_reinitialize_callback without proper capability checks.
• File System: Sudden absence of plugin options in the wp_options table (e.g., imagerecycle_settings, imagerecycle_logs).

Detection Engineering

YARA Rule

rule CVE_2024_1091_ImageRecycle_Missing_Capability_Check {
    meta:
        description = "Detects missing capability check in ImageRecycle plugin reinitialize function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1091"
    strings:
        $func = "imagerecycle_reinitialize_callback" nocase
        $ajax = "wp_ajax_imagerecycle_reinitialize" nocase
        $cap = "current_user_can" nocase
    condition:
        $func and $ajax and not $cap
}

Sigma Rule

title: CVE-2024-1091 ImageRecycle Unauthorized Reinitialize
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized AJAX requests to reinitialize ImageRecycle plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=imagerecycle_reinitialize'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1091 ImageRecycle Unauthorized Reinitialize Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=imagerecycle_reinitialize";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the ImageRecycle plugin until a patch is applied.
2. Update: Apply the latest version of the plugin once a patch is released (check the WordPress plugin repository).
3. Workaround: Implement a custom capability check via a WordPress plugin or mu-plugin to restrict access to the reinitialize function.
4. Monitoring: Enable logging for AJAX requests and monitor for suspicious activity.
5. Access Control: Review user roles and ensure only trusted users have subscriber-level access.

Valters IT
Securing Digital Frontiers