CVE-2024-11087

Executive Summary

CVE-2024-11087 is a critical authentication bypass vulnerability in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress. The flaw resides in the insufficient verification of the user identity returned by the social login token. An unauthenticated attacker can exploit this to log in as any existing user on the site, including administrators, provided they know the target username and the user does not already have an account linked to the social service. This effectively bypasses all authentication controls, leading to full site compromise.

This vulnerability affects all versions up to and including 200.3.9. No official patch has been released at the time of analysis. The CVSS score is 8.1 (High), and the EPSS probability is 0.0%, indicating low active exploitation in the wild, but the risk remains severe due to the simplicity of exploitation.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users who have installed the plugin from any source are at risk. There is no known supply chain compromise of the plugin itself, but the lack of a patch means that all installations remain vulnerable. Administrators should treat this as a critical supply chain risk and either remove the plugin or apply virtual patching via a Web Application Firewall (WAF).

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full read access to all user data and site content.
• Integrity (I): High (H) – Full write access, can modify site content, install plugins, etc.
• Availability (A): High (H) – Can delete content, lock out administrators, or deface the site.

CVSS Score: 8.1 (High)

Threat Level: Critical. The vulnerability allows complete account takeover with no user interaction. An attacker can gain administrative access and fully compromise the WordPress site.

Deep Dive & Mechanics

The miniOrange Social Login plugin allows users to authenticate using social media accounts (Discord, Google, Twitter, LinkedIn). The authentication flow typically works as follows:

1. User clicks "Login with [Social Service]".
2. User is redirected to the social service's OAuth/OpenID Connect endpoint.
3. User authorizes the application.
4. Social service returns an authorization code or token to the plugin's callback URL.
5. Plugin exchanges the code for an access token and retrieves user information (email, name, etc.) from the social service.
6. Plugin checks if a WordPress user with that email exists. If yes, logs them in. If no, creates a new user.

The Vulnerability: In step 6, the plugin fails to properly verify that the user information returned by the social token actually belongs to the user who initiated the login. Specifically, it does not validate the sub (subject) claim or the aud (audience) claim against the expected client ID. An attacker can craft a malicious request to the callback URL, providing a valid token for a different user (or a token they obtained from a different client) and specifying a target username. The plugin will then log the attacker in as that user.

Attack Scenario:

1. Attacker identifies a target WordPress site using the vulnerable plugin.
2. Attacker knows the username of an administrator (e.g., "admin").
3. Attacker obtains a valid social login token for any user (e.g., by creating their own social app and generating a token, or by intercepting a token from another user).
4. Attacker sends a crafted HTTP request to the plugin's callback endpoint, including the token and specifying the target username.
5. The plugin processes the token, retrieves the user info, and logs the attacker in as the target user (the administrator).

Vulnerable vs. Patched Code

Since no official patch is available, we can only analyze the vulnerable code pattern. The vulnerable logic is likely in the mo_oauth_login or similar function that handles the callback.

Vulnerable Code (Conceptual):

// Vulnerable: No verification that the token's user matches the requested user
function mo_oauth_callback() {
    $token = $_GET['token'];
    $username = $_GET['username']; // Attacker controls this
    $user_info = get_user_info_from_token($token);
    // $user_info contains email, name, etc.
    $user = get_user_by('email', $user_info['email']);
    if ($user) {
        wp_set_auth_cookie($user->ID);
        // Attacker is now logged in as $user, which may be the admin
    }
}

Patched Code (Conceptual):

// Patched: Verify that the token's user matches the requested user
function mo_oauth_callback() {
    $token = $_GET['token'];
    $username = $_GET['username'];
    $user_info = get_user_info_from_token($token);
    // Verify the token's audience and subject
    if (!verify_token_audience($token, OAUTH_CLIENT_ID)) {
        wp_die('Invalid token audience');
    }
    if (!verify_token_subject($token, $username)) {
        wp_die('Token user does not match requested user');
    }
    $user = get_user_by('email', $user_info['email']);
    if ($user) {
        wp_set_auth_cookie($user->ID);
    }
}

The key fix is to validate that the token's sub claim matches the user being logged in, and that the aud claim matches the plugin's client ID.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 200.3.9).
• Knowledge of a target username (e.g., "admin").
• A valid social login token. This can be obtained by:
  • Creating your own OAuth app on a social platform (e.g., Google, Discord) and generating a token for any user.
  • Using a token from a legitimate user (e.g., via phishing or interception).

Exploit Steps:

1. Identify the callback URL. It is typically /wp-content/plugins/miniorange-social-login/oauth.php or similar.
2. Craft a request to the callback URL with the following parameters:
   • token: The valid social login token.
   • username: The target username (e.g., "admin").
   • action: login (or similar).
3. Send the request using curl or a browser.

Example curl command:

curl -v "https://target-site.com/wp-content/plugins/miniorange-social-login/oauth.php?action=login&token=VALID_TOKEN&username=admin"

If successful, the server will set a WordPress authentication cookie for the "admin" user. The attacker can then use this cookie to access the WordPress admin dashboard.

Note: No public exploit code is available in Exploit-DB at this time. The above is a conceptual exploitation method.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual callback requests to the miniOrange plugin's OAuth endpoint.
• Look for requests where the username parameter is set to a privileged user (e.g., admin, editor).
• Monitor for successful logins from IP addresses that have no prior history of social login attempts.
• Check for log entries showing a user logged in via social login but without a corresponding social account linked to their profile.

Hardening (until a patch is available):

1. Disable the plugin: If the plugin is not essential, deactivate and delete it.
2. Virtual Patching: Use a Web Application Firewall (WAF) to block requests to the OAuth callback endpoint that contain a username parameter.
3. Restrict Access: Limit access to the WordPress admin area to specific IP addresses.
4. Monitor User Accounts: Regularly audit user accounts for unauthorized changes or new admin accounts.
5. Implement 2FA: Add two-factor authentication for all administrator accounts to mitigate the impact of a successful login bypass.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-content/plugins/miniorange-social-login/oauth.php with a username parameter.
  • Unusual social login tokens from unexpected OAuth providers.
  • Login events from IP addresses not associated with the legitimate user's social login history.

• Host IOCs:

  • New WordPress admin accounts created shortly after a social login event.
  • Changes to user roles (e.g., subscriber to administrator) without a corresponding password change.
  • Log entries in /var/log/apache2/access.log or /var/log/nginx/access.log showing the callback URL with a username parameter.

• File IOCs:

  • Modified plugin files (though unlikely, as the vulnerability is in the code logic, not file integrity).
  • Suspicious files uploaded to the WordPress uploads directory after a compromise.

Detection Engineering

YARA Rule

rule miniOrange_AuthBypass_CVE_2024_11087 {
    meta:
        description = "Detects exploitation attempts of CVE-2024-11087 in miniOrange Social Login plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11087"
        severity = "critical"
    strings:
        $callback = "oauth.php" nocase
        $username_param = "username=" nocase
        $token_param = "token=" nocase
        $action_login = "action=login" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-11087 - miniOrange Social Login Authentication Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the miniOrange Social Login plugin's OAuth callback with a username parameter, indicating an authentication bypass attempt.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11087
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'oauth.php'
            - 'username='
            - 'token='
            - 'action=login'
    condition: selection
falsepositives:
    - Legitimate social login attempts (rare, as username parameter is not normally passed)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11087 - miniOrange Social Login Authentication Bypass"; flow:to_server,established; content:"oauth.php"; http_uri; content:"username="; http_uri; content:"token="; http_uri; content:"action=login"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations.
2. Apply virtual patching using a WAF to block requests to the OAuth callback endpoint that contain a username parameter.
3. Monitor logs for any signs of exploitation (see IOCs and Detection Engineering sections).

Long-Term Remediation:

1. Wait for an official patch from miniOrange. Check their website and the WordPress plugin repository for updates.
2. Upgrade to a patched version once available.
3. Consider alternative social login plugins that have a better security track record.
4. Implement a Web Application Firewall (WAF) with rules to detect and block this type of attack.

Workaround (if plugin cannot be disabled):

• Modify the plugin's code to add the missing verification (see Patched Code section). This is not recommended for non-developers, as it may break the plugin's functionality.

Valters IT
Securing Your Digital Frontier