CVE-2024-12335

Executive Summary

CVE-2024-12335 is an information exposure vulnerability in the Avada (Fusion) Builder plugin for WordPress, affecting all versions up to and including 3.11.12. The flaw resides in the handle_clone_post() function and the fusion_blog shortcode, which fail to enforce proper access controls on which posts can be included or cloned. This allows authenticated attackers with contributor-level access or higher to extract sensitive data from password-protected, private, or draft posts that they should not have access to. The vulnerability has a CVSS score of 4.3 (Medium) and a low EPSS score of 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and commercial channels. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. The lack of a patch increases supply chain risk, as users must rely on manual mitigations or third-party security plugins.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of restricted post data)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the low complexity and network-based attack vector, but the impact is limited to information disclosure. The vulnerability does not allow for data modification or denial of service.

Deep Dive & Mechanics

The vulnerability stems from insufficient authorization checks in two areas of the Avada (Fusion) Builder plugin:

1. handle_clone_post() function: This function is used to clone posts within the WordPress admin interface. It fails to verify that the authenticated user has the capability to read the original post being cloned. As a result, a contributor-level user can clone password-protected, private, or draft posts, thereby gaining access to their content.

2. fusion_blog shortcode: This shortcode is used to display blog posts on the front end. It does not properly filter out posts that the current user should not have access to, such as private or draft posts. An authenticated attacker can craft a request using this shortcode to enumerate and extract content from restricted posts.

The root cause is a missing or insufficient capability check (CWE-639: Authorization Bypass Through User-Controlled Key). The plugin relies on post IDs or other user-supplied parameters without verifying that the user has the read_post capability for the target post.

Vulnerable vs. Patched Code

Since no official patch is available, the following analysis is based on the vulnerable code pattern.

Vulnerable Code (handle_clone_post function):

function handle_clone_post() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // Missing capability check: current_user_can('read_post', $post_id)
    if ($post) {
        // Clone the post
        $new_post = array(
            'post_title' => $post->post_title . ' (Clone)',
            'post_content' => $post->post_content,
            'post_status' => 'draft',
            'post_type' => $post->post_type,
        );
        wp_insert_post($new_post);
    }
}

Patched Code (Hypothetical):

function handle_clone_post() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // Added capability check
    if ($post && current_user_can('read_post', $post_id)) {
        // Clone the post
        $new_post = array(
            'post_title' => $post->post_title . ' (Clone)',
            'post_content' => $post->post_content,
            'post_status' => 'draft',
            'post_type' => $post->post_type,
        );
        wp_insert_post($new_post);
    } else {
        wp_die('You do not have permission to clone this post.');
    }
}

Vulnerable Code (fusion_blog shortcode):

function fusion_blog_shortcode($atts) {
    $args = array(
        'post_type' => 'post',
        'posts_per_page' => 10,
        'post__in' => explode(',', $atts['include']),
        // Missing 'post_status' => 'publish' filter
    );
    $query = new WP_Query($args);
    // Output posts without checking user capabilities
    while ($query->have_posts()) {
        $query->the_post();
        echo get_the_content();
    }
}

Patched Code (Hypothetical):

function fusion_blog_shortcode($atts) {
    $args = array(
        'post_type' => 'post',
        'posts_per_page' => 10,
        'post__in' => explode(',', $atts['include']),
        'post_status' => 'publish', // Only show published posts
        'perm' => 'readable', // Additional check for readability
    );
    $query = new WP_Query($args);
    while ($query->have_posts()) {
        $query->the_post();
        // Additional capability check
        if (current_user_can('read_post', get_the_ID())) {
            echo get_the_content();
        }
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Avada (Fusion) Builder plugin version <= 3.11.12
• Authenticated user account with contributor-level access or higher

Exploitation Steps:

1. Clone Post Exploitation:

   • Log in as a contributor.
   • Send a POST request to /wp-admin/admin-ajax.php with the action fusion_clone_post and the target post ID.
   • Example using cURL:

     curl -X POST \
       -d "action=fusion_clone_post&post_id=123" \
       -c cookies.txt \
       -b cookies.txt \
       http://target-site/wp-admin/admin-ajax.php
     

   • The cloned post will be created as a draft, which the attacker can then view.

2. Shortcode Exploitation:

   • Create a new post or page as a contributor.
   • Insert the shortcode: [fusion_blog include="123,124,125"] where the IDs are of private/draft posts.
   • Publish or preview the page to see the content of the restricted posts.

Lab Setup:

• Use a local WordPress environment (e.g., Docker, Local by Flywheel).
• Install Avada (Fusion) Builder version 3.11.12.
• Create a private post and a contributor user.
• Execute the above steps to verify the vulnerability.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the fusion_clone_post action from low-privileged users.
• Look for shortcodes containing fusion_blog with include parameters that reference non-public post IDs.
• Review server logs for access to draft/private posts by users who should not have permission.

Prevention:

• Apply the principle of least privilege; restrict contributor-level users from using shortcodes that can expose data.
• Use a Web Application Firewall (WAF) to block requests with suspicious shortcode parameters.
• Implement a custom plugin that adds capability checks to the vulnerable functions (see patched code above).
• Regularly update the Avada (Fusion) Builder plugin once a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=fusion_clone_post and a numeric post_id parameter.
  • HTTP requests containing [fusion_blog include=" followed by numeric IDs.
• File IOCs:
  • Modified or newly created draft posts that are clones of private/password-protected posts.
• Log IOCs:
  • WordPress debug log entries showing WP_Query results for non-public post statuses by low-privileged users.
  • Server access logs showing repeated access to admin-ajax.php from the same user.

Detection Engineering

YARA Rule

rule Detect_Avada_Fusion_Builder_Info_Exposure {
    meta:
        description = "Detects exploitation attempts of CVE-2024-12335 in Avada Fusion Builder"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12335"
    strings:
        $ajax_action = "fusion_clone_post"
        $shortcode = "[fusion_blog"
        $include_param = "include="
    condition:
        any of ($ajax_action, $shortcode) and $include_param
}

Sigma Rule

title: Avada Fusion Builder Information Exposure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-12335 via AJAX or shortcode
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection_ajax:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=fusion_clone_post'
    selection_shortcode:
        cs-uri-query|contains: '[fusion_blog'
        cs-uri-query|contains: 'include='
    condition: selection_ajax or selection_shortcode
falsepositives:
    - Legitimate use of clone functionality by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12335 Avada Fusion Builder Information Exposure"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=fusion_clone_post"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable plugin if it is not critical to operations.
2. Restrict contributor-level users from using shortcodes or AJAX actions that can expose data.
3. Apply a virtual patch using a WAF to block requests containing fusion_clone_post or [fusion_blog with include parameters.

Long-term Fix:

• Monitor the Avada vendor for an official patch and apply it as soon as it is released.
• Implement a custom plugin that adds capability checks to the handle_clone_post() function and the fusion_blog shortcode (see patched code examples).
• Conduct a security audit of all WordPress plugins to identify similar authorization bypass vulnerabilities.

Workaround:

• Use a role editor plugin to remove the edit_posts capability from contributor roles, preventing them from using shortcodes.
• Add the following code to the theme's functions.php file to block the vulnerable AJAX action:

  add_action('wp_ajax_fusion_clone_post', function() {
      if (!current_user_can('edit_others_posts')) {
          wp_die('Unauthorized');
      }
  }, 1);
  

Valters IT
Securing Digital Frontiers