CVE-2024-13370

Executive Summary

CVE-2024-13370 is a Missing Authorization vulnerability in the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin, affecting all versions up to and including 1.3.3. The flaw resides in the save_addon_key_license() function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to update arbitrary WordPress options to a valid license key value. While the CVSS score is 6.5 (Medium), the impact is limited to unauthorized modification of plugin license keys, which could lead to privilege escalation or bypass of licensing restrictions. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any future patches immediately. Since the plugin is part of the WordPress ecosystem, supply chain risks include potential backdoors in unpatched versions or malicious forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (license key manipulation)
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but is trivial for any logged-in user. The impact is limited to altering license keys, which could enable unauthorized premium features or cause licensing conflicts.

Deep Dive & Mechanics

The vulnerability exists in the save_addon_key_license() function within the Youzify plugin. This function is intended to save license keys for add-ons, but it does not verify that the current user has administrative privileges (e.g., manage_options capability). As a result, any authenticated user (Subscriber or above) can call this function via an AJAX action or direct request.

The function likely uses update_option() to store the license key in the WordPress options table. By manipulating the option name parameter, an attacker could overwrite arbitrary options, though the value is constrained to a valid license key format. This could be used to:

• Activate premium add-ons without a valid license.
• Override security-related options if they accept a license key format.
• Potentially chain with other vulnerabilities for privilege escalation.

The missing capability check is a classic CWE-862: Missing Authorization flaw.

Vulnerable vs. Patched Code

Vulnerable Code (<=1.3.3):

function save_addon_key_license() {
    // No capability check
    $addon = sanitize_text_field($_POST['addon']);
    $license_key = sanitize_text_field($_POST['license_key']);
    update_option('youzify_license_' . $addon, $license_key);
    wp_send_json_success();
}

Patched Code (Hypothetical):

function save_addon_key_license() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $addon = sanitize_text_field($_POST['addon']);
    $license_key = sanitize_text_field($_POST['license_key']);
    update_option('youzify_license_' . $addon, $license_key);
    wp_send_json_success();
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: A WordPress site with Youzify <=1.3.3 and a valid user account with Subscriber role.
2. Exploit Steps:
   • Log in as a Subscriber.
   • Send a POST request to /wp-admin/admin-ajax.php with action save_addon_key_license, addon parameter (e.g., premium_addon), and license_key parameter (any valid license key format).
   • The option youzify_license_premium_addon will be updated.
3. Example Request (cURL):

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=save_addon_key_license&addon=premium_addon&license_key=VALID-KEY-12345" \
     --cookie "wordpress_logged_in_<hash>=<session_cookie>"
   

Blue Team

1. Detection: Monitor AJAX requests to admin-ajax.php with action save_addon_key_license from non-admin users.
2. Log Analysis: Check WordPress debug log for unexpected update_option calls on youzify_license_* options.
3. Honeypot: Create a fake option youzify_license_honeypot and alert if it is modified.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/youzify/includes/admin/class-youzify-license.php (or similar path containing the vulnerable function)
• Option: youzify_license_* entries in wp_options table modified by non-admin users.
• Log Entry: AJAX request to admin-ajax.php with action=save_addon_key_license from a user with role subscriber.
• Network: POST requests to /wp-admin/admin-ajax.php with parameters addon and license_key.

Detection Engineering

YARA Rule

rule CVE_2024_13370_Youzify_Missing_Auth {
    meta:
        description = "Detects vulnerable Youzify plugin code with missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13370"
    strings:
        $func = "save_addon_key_license" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        $func and not $no_check
}

Sigma Rule

title: CVE-2024-13370 Youzify License Key Unauthorized Update
id: 8a3f2c1e-5d7b-4a9c-8e1f-2b3c4d5e6f7a
status: experimental
description: Detects unauthorized AJAX requests to save_addon_key_license by non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        action: "save_addon_key_license"
        user_role|contains: "subscriber"
    condition: selection
falsepositives:
    - Legitimate admin actions (if role check is misconfigured)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13370 Youzify License Key Exploit"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=save_addon_key_license"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Youzify plugin if not essential, or restrict access to the admin-ajax.php endpoint for non-admin users via .htaccess or a Web Application Firewall (WAF).
2. Short-term: Apply a virtual patch by adding a capability check to the save_addon_key_license() function using a code snippet plugin:

   add_action('wp_ajax_save_addon_key_license', function() {
       if (!current_user_can('manage_options')) {
           wp_die('Unauthorized', 403);
       }
   }, 1);
   

3. Long-term: Monitor the plugin repository for an official patch. Consider migrating to an alternative BuddyPress plugin if the vendor remains unresponsive.
4. Detection: Implement the provided Sigma and Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers