CVE-2024-13364

Executive Summary

CVE-2024-13364 is a security vulnerability in the Raptive Ads WordPress plugin, affecting all versions up to and including 3.6.3. The vulnerability stems from a missing capability check in the site_ads_files_reset() and cls_file_reset() functions, allowing unauthenticated attackers to reset the plugin's ad and CLS (Cumulative Layout Shift) files. This can lead to denial of service or disruption of ad serving functionality. The CVSS score is 5.3 (Medium), and no public exploit code or patch is currently available. As a WordPress plugin vulnerability, it is critical to address within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability is specific to the Raptive Ads WordPress plugin, which is distributed via the WordPress plugin repository and third-party marketplaces. Organizations using this plugin should verify its integrity and ensure no unauthorized modifications have been made. No known supply chain attacks have been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the low complexity and no authentication requirement, but the impact is limited to integrity (resetting files) without data breach or service downtime.

Deep Dive & Mechanics

The vulnerability exists in the site_ads_files_reset() and cls_file_reset() functions within the Raptive Ads plugin. These functions are intended to reset ad configuration files and CLS-related files, respectively. However, they lack a capability check (e.g., current_user_can('manage_options')), allowing any unauthenticated user to trigger them via direct HTTP requests.

The functions likely use WordPress AJAX hooks or direct URL endpoints. An attacker can send a crafted request to reset these files, potentially disrupting ad serving or causing layout issues. The exact file paths and reset mechanisms are not publicly documented, but the impact is limited to file integrity.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main PHP file (e.g., raptive-ads.php). The missing capability check would be in functions like:

function site_ads_files_reset() {
    // Reset ad files
    // Missing: if (!current_user_can('manage_options')) { wp_die('Unauthorized'); }
}

A patched version would add:

function site_ads_files_reset() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Reset ad files
}

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code exists, a proof-of-concept can be crafted. The attacker sends a direct HTTP request to the vulnerable endpoint. Example using curl:

curl -X POST "http://target.com/wp-admin/admin-ajax.php?action=site_ads_files_reset"

Or via a direct URL if the function is exposed without AJAX:

curl "http://target.com/wp-content/plugins/raptive-ads/reset.php?action=cls_file_reset"

The exact endpoint depends on the plugin's implementation. An attacker can automate this to repeatedly reset files, causing persistent disruption.

Blue Team (Detection & Defense)

• Web Application Firewall (WAF): Block requests to known vulnerable endpoints (e.g., site_ads_files_reset, cls_file_reset).
• Input Validation: Monitor for unexpected POST/GET requests to plugin-specific actions.
• File Integrity Monitoring (FIM): Alert on changes to ad and CLS files.
• Disable Plugin: If no patch is available, disable the Raptive Ads plugin until a fix is released.

Indicators of Compromise (IOCs)

• File Changes: Unauthorized modification or reset of files in /wp-content/plugins/raptive-ads/ (e.g., ads-config.json, cls-settings.json).
• HTTP Requests: POST/GET requests to /wp-admin/admin-ajax.php with action=site_ads_files_reset or action=cls_file_reset from unauthenticated sources.
• Logs: WordPress debug logs showing calls to site_ads_files_reset() or cls_file_reset() without proper user context.

Detection Engineering

YARA Rule

rule CVE_2024_13364_Raptive_Ads_Reset {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13364 in Raptive Ads plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13364"
    strings:
        $func1 = "site_ads_files_reset" ascii wide
        $func2 = "cls_file_reset" ascii wide
        $ajax = "admin-ajax.php" ascii wide
    condition:
        any of ($func*) and $ajax
}

Sigma Rule

title: CVE-2024-13364 Raptive Ads Unauthorized File Reset
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to reset Raptive Ads plugin files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=site_ads_files_reset'
            - 'action=cls_file_reset'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13364 Raptive Ads Unauthorized File Reset"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=site_ads_files_reset"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Raptive Ads plugin if not critical, or restrict access to its endpoints via .htaccess or WAF rules.
2. Patch: Monitor the vendor (Raptive) for a patched version. Apply as soon as available.
3. Workaround: Add capability checks via a custom plugin or code snippet:

   add_action('init', function() {
       if (isset($_REQUEST['action']) && in_array($_REQUEST['action'], ['site_ads_files_reset', 'cls_file_reset'])) {
           if (!current_user_can('manage_options')) {
               wp_die('Unauthorized');
           }
       }
   });
   

4. Monitoring: Enable logging for all plugin-related actions and review regularly.

Valters IT
DevSecOps & Cyber Threat Intelligence