CVE-2024-12600

Executive Summary

CVE-2024-12600 is a critical PHP Object Injection vulnerability discovered in the Custom Product Tabs Lite for WooCommerce WordPress plugin, affecting all versions up to and including 1.9.0. The flaw resides in the insecure deserialization of user-supplied input from the frs_woo_product_tabs parameter. An authenticated attacker with Shop Manager-level privileges or higher can inject arbitrary PHP objects. While no known POP (Property Oriented Programming) chain exists within the plugin itself, the presence of a POP chain in another installed plugin or theme could allow an attacker to delete arbitrary files, exfiltrate sensitive data, or achieve remote code execution. The vulnerability is currently unpatched, and no public proof-of-concept exploit has been released.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress ecosystem, affecting a WooCommerce plugin. It does not involve Apache, Nginx, or other web server software. The attack surface is limited to authenticated users with elevated roles (Shop Manager or Administrator), but the potential impact is severe if a POP chain is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): High – Requires Shop Manager-level access or higher.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): High – Potential data exfiltration.
• Integrity (I): High – Potential file deletion or modification.
• Availability (A): High – Potential denial of service or code execution.

Threat Level: High. Although the EPSS score is 0.0% (indicating low exploitation likelihood currently), the lack of a patch and the potential for severe impact if a POP chain is present make this a significant risk for affected WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection flaw caused by the insecure use of unserialize() on user-controllable input. The plugin processes the frs_woo_product_tabs parameter, which is expected to contain serialized data for custom product tabs. However, the plugin does not validate or sanitize this input before passing it to unserialize().

Technical Flow:

1. An authenticated user with Shop Manager privileges or higher accesses the product editing interface.
2. The plugin retrieves the frs_woo_product_tabs parameter from the request (likely via $_POST or $_GET).
3. The parameter value is passed directly to PHP's unserialize() function without any filtering.
4. If the attacker crafts a malicious serialized object, PHP will instantiate that object and call its __wakeup() or __destruct() magic methods if they exist.
5. Without a POP chain in the plugin, the injected object cannot perform malicious actions. However, if another plugin or theme on the same WordPress installation contains a suitable POP chain (e.g., classes with __wakeup() or __destruct() that perform dangerous operations), the attacker can chain them to achieve code execution, file deletion, or data exfiltration.

Key Code Snippet (Vulnerable):

// Hypothetical vulnerable code in the plugin
$tabs_data = unserialize($_POST['frs_woo_product_tabs']);
// Process $tabs_data...

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code and the ideal fix.

Vulnerable Code (<= 1.9.0):

// In a file like class-frs-woo-product-tabs.php
public function save_product_tabs($post_id) {
    if (isset($_POST['frs_woo_product_tabs'])) {
        $tabs = unserialize(stripslashes($_POST['frs_woo_product_tabs']));
        update_post_meta($post_id, '_frs_woo_product_tabs', $tabs);
    }
}

Patched Code (Ideal Fix):

// Use JSON instead of serialization
public function save_product_tabs($post_id) {
    if (isset($_POST['frs_woo_product_tabs'])) {
        $tabs = json_decode(stripslashes($_POST['frs_woo_product_tabs']), true);
        if (json_last_error() === JSON_ERROR_NONE) {
            update_post_meta($post_id, '_frs_woo_product_tabs', $tabs);
        } else {
            // Handle invalid JSON
        }
    }
}

The fix replaces unserialize() with json_decode(), which is safe from object injection. Additionally, input validation and sanitization should be applied.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress installation with Custom Product Tabs Lite <= 1.9.0.
• A user account with Shop Manager role or higher.
• A POP chain available in another installed plugin or theme (e.g., a plugin with a class that has a dangerous __destruct() method).

Exploitation Steps:

1. Identify a POP chain in the target environment. For example, a plugin with a class like:

   class EvilClass {
       public $file_path;
       public function __destruct() {
           unlink($this->file_path);
       }
   }
   

2. Craft a malicious serialized object that instantiates the POP chain class with desired properties.

   $payload = serialize(new EvilClass());
   $payload = str_replace('O:9:"EvilClass"', 'O:9:"EvilClass"', $payload); // Adjust class name
   

3. Send a POST request to the product edit page with the malicious serialized data:

   POST /wp-admin/post.php?post=123&action=edit HTTP/1.1
   Host: target.com
   Cookie: [authenticated session cookie]
   Content-Type: application/x-www-form-urlencoded
   
   frs_woo_product_tabs=[malicious_serialized_string]
   

4. The server deserializes the input, triggers the POP chain, and executes the attacker's desired action (e.g., file deletion).

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection Strategies:

• Monitor for unusual serialized data in POST requests to wp-admin/post.php or similar endpoints.
• Look for PHP error logs indicating deserialization failures or unexpected object instantiation.
• Use Web Application Firewall (WAF) rules to block requests containing serialized PHP objects (e.g., O:\d+:" pattern).

Honeypot Setup:

• Deploy a decoy WordPress site with the vulnerable plugin and a fake POP chain plugin to lure attackers.
• Log all attempts to exploit the frs_woo_product_tabs parameter.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/post.php with parameter frs_woo_product_tabs containing serialized PHP objects (e.g., O:8:"stdClass":0:{}).
  • Unusual User-Agent strings or IP addresses associated with known scanning tools.

• File System IOCs:

  • Unexpected files in the WordPress uploads directory or wp-content.
  • Modified or deleted files in sensitive directories (e.g., wp-config.php).

• Log IOCs:

  • PHP error logs containing unserialize() errors or __destruct() calls.
  • WordPress debug logs showing unexpected object instantiation.

Detection Engineering

YARA Rule

rule CVE_2024_12600_PHP_Object_Injection {
    meta:
        description = "Detects PHP serialized objects in POST requests targeting Custom Product Tabs Lite"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-12600"
    strings:
        $serialized = /frs_woo_product_tabs=.*O:\d+:"/
    condition:
        $serialized
}

Sigma Rule

title: CVE-2024-12600 - PHP Object Injection via Custom Product Tabs Lite
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of PHP Object Injection in Custom Product Tabs Lite for WooCommerce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'frs_woo_product_tabs'
        cs-uri-query|re: 'O:\d+:"'
    condition: selection
falsepositives:
    - Legitimate plugin updates or admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12600 - PHP Object Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"frs_woo_product_tabs"; http_client_body; pcre:"/O:\d+:\"/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released. If the plugin is essential, restrict Shop Manager access to trusted users only.
2. Apply a virtual patch using a WAF to block requests containing serialized PHP objects in the frs_woo_product_tabs parameter.
3. Audit all installed plugins and themes for potential POP chains. Remove any that are unnecessary or outdated.

Long-Term Fix:

• The vendor (Yith) should release a patched version that replaces unserialize() with json_decode() or implements proper input validation.
• Until then, consider using an alternative plugin for custom product tabs.

Monitoring:

• Enable detailed logging for WordPress admin actions.
• Regularly review PHP error logs and web server access logs for suspicious patterns.

Valters IT
Securing Digital Frontiers