CVE-2024-1338

Executive Summary

CVE-2024-1338 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the ImageRecycle pdf & image compression plugin for WordPress, up to and including version 3.1.13. The vulnerability exists due to missing or incorrect nonce validation on the stopOptimizeAll function. This allows an unauthenticated attacker to forge a request that, when triggered by a logged-in site administrator (e.g., by clicking a malicious link), can modify image optimization settings without the administrator's consent. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim (administrator) must click a link or perform an action.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can modify image optimization settings.
• Availability (A): None – No denial of service impact.

Threat Level: Medium. While the impact is limited to configuration changes, the attack requires no authentication and can be executed via social engineering.

Deep Dive & Mechanics

The vulnerability resides in the stopOptimizeAll function within the ImageRecycle plugin. This function is intended to stop all ongoing image optimization processes. However, it lacks proper CSRF protection (nonce validation). In WordPress, nonces are used to verify that requests originate from the legitimate user and not from a third party. Without this check, an attacker can craft a malicious link or form that, when visited by an authenticated administrator, will execute the stopOptimizeAll action.

The attack flow:

1. The attacker identifies a WordPress site using a vulnerable version of the ImageRecycle plugin.
2. The attacker crafts a URL or HTML form that triggers the stopOptimizeAll function.
3. The attacker lures an administrator to click the link or submit the form (e.g., via email, social media, or a compromised site).
4. The administrator's browser sends the forged request, including their valid session cookies.
5. The plugin processes the request without verifying the nonce, altering the optimization settings.

This could lead to disruption of image optimization services, potentially affecting site performance or user experience.

Vulnerable vs. Patched Code

The vulnerable code is in the stopOptimizeAll function, which likely looks like:

public function stopOptimizeAll() {
    // Missing nonce check
    update_option('imagerecycle_optimize_all_status', 'stopped');
    // ... other actions
}

A patched version would include a nonce verification:

public function stopOptimizeAll() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'stop_optimize_all')) {
        wp_die('Security check failed.');
    }
    update_option('imagerecycle_optimize_all_status', 'stopped');
    // ... other actions
}

The patch ensures that only requests with a valid nonce (generated by WordPress for the current user session) are processed.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with ImageRecycle plugin version <= 3.1.13.
• An authenticated administrator session.

Exploitation Steps:

1. Identify the vulnerable endpoint. Typically, it is an AJAX action or admin page. For example: /wp-admin/admin-ajax.php?action=stopOptimizeAll.
2. Craft a CSRF exploit. This can be a simple HTML page with a form that auto-submits:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="stopOptimizeAll">
    <input type="submit" value="Click here">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

3. Host the HTML page on an attacker-controlled server.
4. Send the link to the administrator via phishing email or social engineering.
5. Once the administrator visits the page, the request is sent with their cookies, and the optimization settings are modified.

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual requests to /wp-admin/admin-ajax.php with action=stopOptimizeAll from non-admin IPs or without a valid referer.
• Check server logs for POST requests to the vulnerable endpoint without a nonce parameter.

Prevention:

• Ensure the plugin is updated to the latest patched version.
• Implement Web Application Firewall (WAF) rules to block requests missing nonce parameters.
• Educate administrators about phishing attacks and the importance of not clicking suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=stopOptimizeAll and no _wpnonce parameter.
  • Referer headers from unexpected domains.
• Host IOCs:
  • Changes to the imagerecycle_optimize_all_status option in the WordPress database.
  • Unusual entries in WordPress debug logs related to the ImageRecycle plugin.
• File IOCs:
  • Modified plugin files (e.g., imagerecycle-pdf-image-compression/imagerecycle.php) if the attacker gains further access.

Detection Engineering

YARA Rule

rule CVE_2024_1338_ImageRecycle_CSRF {
    meta:
        description = "Detects vulnerable ImageRecycle plugin files with missing nonce in stopOptimizeAll"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1338"
    strings:
        $func = "stopOptimizeAll" nocase
        $nonce = "_wpnonce" nocase
        $nonce_check = "wp_verify_nonce" nocase
    condition:
        $func and not $nonce and not $nonce_check
}

Sigma Rule

title: CVE-2024-1338 - ImageRecycle CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable ImageRecycle endpoint without nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=stopOptimizeAll"
        cs-uri-query|contains: "admin-ajax.php"
    filter:
        cs-uri-query|contains: "_wpnonce"
    condition: selection and not filter
falsepositives:
    - Legitimate requests from patched versions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1338 - ImageRecycle CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=stopOptimizeAll"; http_uri; content:!"_wpnonce"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version is released, update immediately. Currently, no patch is available, so consider disabling the plugin until a fix is released.
2. Implement CSRF protection: If you have custom code, ensure all actions include nonce verification.
3. Use a Web Application Firewall (WAF): Block requests to the vulnerable endpoint that lack a nonce.

Long-term Measures:

• Regularly update all WordPress plugins and themes.
• Conduct security audits of third-party plugins.
• Educate administrators on CSRF and phishing risks.
• Monitor for similar vulnerabilities in other plugins.

Workaround:

• If the plugin is critical, restrict access to the stopOptimizeAll function by adding a capability check (e.g., current_user_can('manage_options')) in addition to the nonce.

Valters IT