CVE-2024-13429

Executive Summary

CVE-2024-13429 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress. This flaw affects all versions up to and including 2.2.6. The vulnerability resides in the jobenforcedelete function, which lacks proper validation on a user-controlled key. This allows authenticated attackers with employer-level access or higher to delete arbitrary job postings, bypassing intended authorization checks. The vulnerability is classified as a WordPress ecosystem issue and is not related to the underlying web server (Apache/Nginx). No public proof-of-concept (PoC) or exploit code is currently available, and the patch status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires employer-level authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized deletion of job postings
• Availability Impact: None (A:N)

The threat level is considered medium due to the requirement for authentication and the limited impact on integrity. However, the vulnerability can be exploited to disrupt recruitment operations by deleting job listings.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the jobenforcedelete function of the WP Job Portal plugin. The function accepts a user-controlled key (likely a job ID) without verifying that the authenticated user has permission to delete that specific job. This allows an attacker with employer-level access to delete any job posting in the system, including those owned by other employers or administrators.

The root cause is the lack of authorization checks on the object reference. The plugin should verify that the job ID belongs to the current user or that the user has the appropriate capability (e.g., delete_others_jobs) before performing the deletion.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.6):

function jobenforcedelete() {
    $job_id = $_POST['job_id'];
    // No authorization check
    wp_delete_post($job_id, true);
}

Patched Code (Hypothetical):

function jobenforcedelete() {
    $job_id = $_POST['job_id'];
    $job = get_post($job_id);
    if (!$job || $job->post_type !== 'job') {
        wp_die('Invalid job');
    }
    if (current_user_can('delete_post', $job_id) || $job->post_author == get_current_user_id()) {
        wp_delete_post($job_id, true);
    } else {
        wp_die('Unauthorized');
    }
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated session with employer-level privileges on a WordPress site running WP Job Portal <= 2.2.6.
2. Steps:
   • Identify a target job ID (e.g., via directory listing or enumeration).
   • Send a POST request to the vulnerable endpoint:

     POST /wp-admin/admin-ajax.php HTTP/1.1
     Host: target-site.com
     Cookie: [valid session cookie]
     Content-Type: application/x-www-form-urlencoded
     
     action=jobenforcedelete&job_id=123
     

   • The job with ID 123 will be deleted without authorization.

Blue Team

1. Detection: Monitor for unusual POST requests to admin-ajax.php with the action=jobenforcedelete parameter.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to jobenforcedelete from non-admin users.
3. Audit: Review logs for unauthorized deletion events and verify user permissions.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=jobenforcedelete and a numeric job_id parameter.
• Logs: WordPress audit logs showing deletion of job posts by unexpected users.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_13429_WP_Job_Portal_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13429 in WP Job Portal"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13429"
    strings:
        $ajax_action = "action=jobenforcedelete"
        $job_id_param = "job_id="
    condition:
        $ajax_action and $job_id_param
}

Sigma Rule

title: CVE-2024-13429 WP Job Portal IDOR Exploitation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b7d3f1a0e4c
status: experimental
description: Detects POST requests to admin-ajax.php with jobenforcedelete action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=jobenforcedelete"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13429 WP Job Portal IDOR Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=jobenforcedelete"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the jobenforcedelete functionality via a custom plugin or code snippet until a patch is available.
2. Short-term: Implement a WAF rule to block requests to jobenforcedelete from non-administrator users.
3. Long-term: Apply the official patch from the vendor when released, or manually fix the code by adding authorization checks as shown in the patched code example.
4. Monitoring: Enable detailed logging for all AJAX actions and review logs for suspicious deletion events.

Valters IT