CVE-2024-13552

Executive Summary

CVE-2024-13552 is an Insecure Direct Object Reference (IDOR) vulnerability in the SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress, affecting all versions up to and including 3.3.0. The flaw resides in the file upload functionality, where a user-controlled key (likely a ticket ID or attachment ID) is not properly validated. This allows authenticated attackers to download attachments from support tickets they do not own. If the administrator enables ticket submission for guests, unauthenticated attackers can also exploit this vulnerability. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been released.

WordPress Ecosystem Context

This vulnerability is specific to the SupportCandy plugin within the WordPress ecosystem. It is not related to Apache or Nginx server software. The plugin is used for helpdesk and customer support ticket management, making it a prime target for data theft and reconnaissance.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Authenticated user; can be None (PR:N) if guest tickets are enabled.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Unauthorized access to attachment data.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized access to sensitive ticket attachments, which may contain personal data, credentials, or internal information. The low EPSS score suggests limited active exploitation, but the lack of a patch increases risk.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the file download functionality of SupportCandy. The plugin likely uses a numeric or predictable identifier (e.g., attachment_id or ticket_id) in the URL or POST request to retrieve files. The code fails to verify that the authenticated user is the owner of the ticket or has the appropriate role to access the attachment.

Attack Flow:

1. An authenticated attacker (or unauthenticated if guest tickets are enabled) identifies the file download endpoint, e.g., /wp-admin/admin-ajax.php?action=sc_download_attachment&attachment_id=123.
2. The attacker iterates through attachment IDs or uses a known valid ID from another ticket.
3. The server returns the file without checking if the attacker is the ticket owner or has the required capability.
4. The attacker downloads sensitive attachments (e.g., screenshots, documents, credentials).

Root Cause: Missing authorization check on the attachment_id parameter. The plugin likely uses current_user_can() or similar checks only for the main ticket view, but not for the file download action.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common IDOR fixes.

Vulnerable Code (PHP):

function sc_download_attachment() {
    $attachment_id = intval($_GET['attachment_id']);
    $file_path = get_attached_file($attachment_id);
    // No ownership check
    header('Content-Type: application/octet-stream');
    readfile($file_path);
}

Patched Code (Hypothetical):

function sc_download_attachment() {
    $attachment_id = intval($_GET['attachment_id']);
    $ticket_id = get_post_meta($attachment_id, 'ticket_id', true);
    if (!current_user_can('view_ticket', $ticket_id)) {
        wp_die('Unauthorized');
    }
    $file_path = get_attached_file($attachment_id);
    header('Content-Type: application/octet-stream');
    readfile($file_path);
}

The patched version verifies that the current user has the capability to view the associated ticket before serving the file.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with SupportCandy plugin <= 3.3.0.
• Valid user account (or guest tickets enabled).

Steps:

1. Log in as a low-privileged user (e.g., subscriber).
2. Identify the file download endpoint. Common patterns:
   • /wp-admin/admin-ajax.php?action=sc_download_attachment&attachment_id=1
   • /wp-json/supportcandy/v1/attachment/1
3. Use a script to brute-force attachment IDs:

   for i in {1..1000}; do
       curl -s -o /dev/null -w "%{http_code}" -b "wordpress_logged_in=..." \
           "http://target/wp-admin/admin-ajax.php?action=sc_download_attachment&attachment_id=$i"
   done
   

4. For successful responses (HTTP 200 with binary content), download the file:

   curl -b "wordpress_logged_in=..." \
       "http://target/wp-admin/admin-ajax.php?action=sc_download_attachment&attachment_id=42" \
       -o leaked_attachment.bin
   

Note: No public exploit code is available. The above is a generic approach.

Blue Team (Detection & Hardening)

Detection:

• Monitor for sequential or rapid requests to the file download endpoint.
• Alert on access to attachment IDs that do not correspond to the user's tickets.
• Use Web Application Firewall (WAF) rules to block brute-force patterns.

Hardening:

• Disable guest ticket submission if not required.
• Implement a temporary workaround by adding a custom plugin hook to validate ownership:

  add_action('wp_ajax_sc_download_attachment', function() {
      $attachment_id = intval($_GET['attachment_id']);
      $ticket_id = get_post_meta($attachment_id, 'ticket_id', true);
      if (!current_user_can('view_ticket', $ticket_id)) {
          wp_die('Unauthorized');
      }
  }, 1);
  

• Monitor for plugin updates and apply patches immediately.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated GET/POST requests to /wp-admin/admin-ajax.php with action=sc_download_attachment and varying attachment_id values.
  • Unusual download patterns from non-admin users.

• File System IOCs:

  • Unexpected files in the WordPress uploads directory that match known attachment IDs.

• Log IOCs:

  • WordPress debug log entries showing failed capability checks (if custom logging is added).
  • Web server access logs with sequential attachment IDs from the same IP.

Detection Engineering

YARA Rule

rule CVE_2024_13552_SupportCandy_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13552 in SupportCandy plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13552"
    strings:
        $ajax_action = "sc_download_attachment"
        $attachment_param = "attachment_id"
    condition:
        all of them
}

Sigma Rule

title: SupportCandy IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects sequential requests to SupportCandy file download endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=sc_download_attachment'
    condition: selection
    timeframe: 5m
    aggregation:
        field: c-ip
        condition: gt 10
falsepositives:
    - Legitimate bulk downloads by administrators
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-13552 SupportCandy IDOR Exploitation Attempt";
    flow:to_server;
    content:"GET"; http_method;
    content:"action=sc_download_attachment"; http_uri;
    content:"attachment_id"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable guest ticket submission in SupportCandy settings to prevent unauthenticated exploitation.
2. Apply a temporary workaround using a custom plugin or theme functions.php to add authorization checks (see Blue Team section).
3. Monitor for plugin updates from the vendor (SupportCandy) and apply the official patch when released.

Long-Term Fix:

• The vendor must release a patched version (e.g., 3.3.1) that implements proper authorization checks on the file download endpoint.
• Consider replacing the plugin with an actively maintained alternative if no patch is forthcoming.

Compensating Controls:

• Implement Web Application Firewall (WAF) rules to block sequential attachment ID requests.
• Restrict file download endpoints to specific user roles using WordPress capabilities.
• Enable logging and alerting on suspicious download patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst